Just like static analysis is performed on the source code, dynamic analysis is performed on the resulting binaries. The "dynamic" in the name refers to the observation of the code in action processing the actual data. When focused on security, this class of tools can also be called Dynamic Application Security Testing (DAST).
Their main advantage over their SAST counterparts is that they can find many flows that cannot be seen from the source code analysis point of view. This, of course, introduces the drawback that you have to run your application in order to perform the analysis. And as we know, running an application can be both time- and memory-consuming.
DAST tools usually focus on web-related vulnerabilities such as XSS, SQL (and other) injection, or disclosed sensitive information. We will focus more on one of the more general-purpose dynamic analysis tools, Valgrind, in the next subsection.
