Characterizing the 'Security Vulnerability Likelihood' of Software Functions