关键词: 安全规则, 静态分析, 可扩展标记语言（XML）, 缺陷模式, Xquery

Abstract: Fatal security vulnerabilities are caused by undefined behaviors of C/C++ language used in Safety-Critical software design.Software static analysis is an important technique for identifying security vulnerabilities from software code and structure.The static analysis method based on XML intermediate model is proposed in term of safety rules.The source code is interpreted as XML intermediate model，while safety rules are translated into vulnerabilities pattern，and Xquery expression is used to locate security vulnerabilities by this method.The experimental result of a prototype system based on this method shows that this method can effectively detect the software vulnerabilities in violation of safety rules and has the advantage of supporting customization of safety rules.

Key words: safety rules, static analysis, eXtensible Markup Language（XML）, vulnerabilities pattern, Xquery