  Software testing is the most commonly used technique in the industry to
certify the correctness of software systems. This includes security properties
like access control and data confidentiality. However, information flow control
and the detection of information leaks using tests is a demanding task without
the use of specialized monitoring and assessment tools.
  In this paper, we tackle the challenge of dynamically tracking information
flow in third-party Java-based applications using dependent information flow
control. Dependent security labels increase the expressiveness of traditional
information flow control techniques by allowing to parametrize labels with
context-related information and allowing for the specification of more detailed
and fine-grained policies. Instead of the fixed security lattice used in
traditional approaches that defines a fixed set of security compartments,
dependent security labels allow for a dynamic lattice that can be extended at
runtime, allowing for new security compartments to be defined using context
values.
  We present a specification and instrumentation approach for rewriting JVM
compiled code with in-lined reference monitors. To illustrate the proposed
approach we use an example and a working prototype, SNITCH. SNITCH operates
over the static single assignment language Shimple, an intermediate
representation for Java bytecode used in the SOOT framework.
