Modeling Security Weaknesses to Enable Practical Run-time Defenses