Software testing is the most commonly used technique in the industry to certify the correctness of software, including security properties like access control and data privacy. However, information flow control and the detection of information leaks using tests, without the use of specialized monitoring and assessment tools, is a demanding task.

In this paper, we tackle the challenge of dynamically tracking information flow in third-party Java-based applications, using dependent security levels. Dependent levels increase the expressiveness of traditional information flow control by parametrizing levels with context-related information and allowing for more detailed and fine-grained policies.

We present ongoing work on a specification and instrumentation approach for rewriting JVM compiled code with in-lined reference monitors. Our prototype works at the level of the single-static assignment SOOT intermediate language Shimple. We illustrate the approach with an example and present a working tool.