With the development of new software technologies and Application Programming Interfaces (APIs), software and system development becomes more complicated and requires for more advanced skill set. Such complexity may result in unwanted or unconscious bugs during the development phase, which can be utilized by cyber-attackers. As software is a crucial part of existing infrastructures, e.g., cyber-physical systems, how to secure the software and system security is a big challenge.