Estimating U.S. arsenal of zero-day vulnerabilities (2016) (jia.sipa.columbia.edu)