ITS4: A Static Vulnerability Scanner for C and C++ Code. - John Viega; J. T. Bloch; Y. Kohno; Gary McGraw (ACSAC, 2000)

Token-based scanning of source code for security problems. - John Viega; J. T. Bloch; Tadayoshi Kohno; Gary McGraw (ACM Trans. Inf. Syst. Secur., 2002)