Frédéric Besson Thomas P. Jensen Daniel Le Métayer Model Checking Security Properties of Control Flow Graphs. 217-250 2001 9 Journal of Computer Security 3 db/journals/jcs/jcs9.html#BessonJM01