Determining expected exploitability of security vulnerabilities

A method comprising:

• implementing, using one or more hardware processors, a process for determining expected exploitability of security vulnerabilities, wherein the implementing comprises:
• inputting, into a multi-headed neural network, vulnerability information corresponding to a security vulnerability;
• outputting, via a probability of exploitation (PoE) head of the multi-headed neural network, a first feature vector extracted, using the multi-headed neural network, from the vulnerability information corresponding to the security vulnerability, wherein the first feature vector comprises a first set of features;
• extracting, from code snippets and using an abstract syntax tree (AST) analyzer, a second feature vector comprising a second set of features determined to be related to the security vulnerability;
• concatenating the first feature vector with the second feature vector to produce a third feature vector that comprises the first set of features and the second set of features;
• and
• determining, using a regression model and based at least in part on the third feature vector, a probability of exploitation for the security vulnerability.

One or more non-transitory computer-accessible storage media storing program instructions that, when executed on or across one or more hardware processors, implement at least a portion of a system that implements a process for determining expected exploitability of security vulnerabilities and cause the system to:

• input, into a multi-headed neural network, vulnerability information corresponding to a security vulnerability;
• output, via a probability of exploitation (PoE) head of the multi-headed neural network, a first feature vector extracted, using the multi-headed neural network, from the vulnerability information corresponding to the security vulnerability, wherein the first feature vector comprises a first set of features;
• extract, from code snippets and using an abstract syntax tree (AST) analyzer, a second feature vector comprising a second set of features determined to be related to the security vulnerability;
• concatenate the first feature vector with the second feature vector to produce a third feature vector that comprises the first set of features and the second set of features;
• and
• determine, using a regression model and based at least in part on the third feature vector, a probability of exploitation for the security vulnerability.