Vulnerability likelihood: a probabilistic approach to software assurance