11. A computer readable hardware medium which embodies computer readable instructions for controlling operation of computer apparatus to implement detection of software vulnerabilities by applying a rule set to test for vulnerabilities in computer software, the rule set comprising at least one vulnerability characterisation rule, wherein the instructions provide for control of the computer apparatus to carry out the steps of: a) receiving a training data set of computer software incorporating positive and negative vulnerability examples and expressed as programs flagged to indicate either presence or absence of vulnerability, the programs comprising instructions each incorporating an identifier to indicate its associated program, the instruction's address, an instruction operator and a list of instruction operands, b) receiving a rule generalisation which is processable to transform it into the at least one vulnerability characterisation rule, and c) processing the rule generalisation to transform it into a more specific rule generalisation by employing logic of at least First-Order and adding to the rule generalisation at least one of a condition, a variable, a constant, a unification of variables and a function based on the training data set and background knowledge relating to attributes of the training data set and consisting of at least one of concepts, facts of interest and functions for calculating values of interest from items of data, d) evaluating the more specific rule generalisation by applying it to the training data set to identify vulnerabilities, and e) incorporating the more specific rule generalisation in the rule set if it classifies vulnerabilities in the training data set adequately in terms of covering at least some of the positive vulnerability examples, f) applying the rule set to a test program for vulnerability detection therein, and g) providing an alert or a report to a user regarding vulnerability detection in the test program resulting from operation of the method in order to enable corrective action to be taken.
11. A computer readable hardware medium which embodies computer readable instructions for controlling operation of computer apparatus to implement detection of software vulnerabilities by applying a rule set to test for vulnerabilities in computer software, the rule set comprising at least one vulnerability characterisation rule, wherein the instructions provide for control of the computer apparatus to carry out the steps of: a) receiving a training data set of computer software incorporating positive and negative vulnerability examples and expressed as programs flagged to indicate either presence or absence of vulnerability, the programs comprising instructions each incorporating an identifier to indicate its associated program, the instruction's address, an instruction operator and a list of instruction operands, b) receiving a rule generalisation which is processable to transform it into the at least one vulnerability characterisation rule, and c) processing the rule generalisation to transform it into a more specific rule generalisation by employing logic of at least First-Order and adding to the rule generalisation at least one of a condition, a variable, a constant, a unification of variables and a function based on the training data set and background knowledge relating to attributes of the training data set and consisting of at least one of concepts, facts of interest and functions for calculating values of interest from items of data, d) evaluating the more specific rule generalisation by applying it to the training data set to identify vulnerabilities, and e) incorporating the more specific rule generalisation in the rule set if it classifies vulnerabilities in the training data set adequately in terms of covering at least some of the positive vulnerability examples, f) applying the rule set to a test program for vulnerability detection therein, and g) providing an alert or a report to a user regarding vulnerability detection in the test program resulting from operation of the method in order to enable corrective action to be taken. 15. A computer readable hardware medium according to claim 11 wherein the rule set incorporates a rule which classifies a program as vulnerable if there is a copying loop with a test for zero, and one other test, but a register referenced by the other test is not used during the loop.