VX Heavens

We derive two models of viral epidemiology on connected networks and compare results to simulations. The differential equation model easily predicts the expected long term behavior by defining a boundary between survival and extinction regions. The discrete Markov model captures the short term behavior dependent on initial conditions, providing extinction probabilities and the fluctuations around the expected behavior. These analysis techniques provide new insight on the persistence of computer viruses and what strategies should be devised for their control.

The communal nature of the Internet exposes organizations and home computer users to a multitude of worms, viruses, and other malicious software (malware) threats such as spyware and Trojan horses. Viruses are program fragments attached to normal programs or files that hijack the execution control of the host program to reproduce copies of the virus. Worms are automated self-replicating programs that seek out and copy themselves to vulnerable new targets over the Internet. In the same way that germs are quickly shared among people, worms can spread rapidly among networked computers. In the second half of 2004, Symantec reported 7,360 new Windows worms and viruses, an increase of 63 percent over the number of new worms and viruses in the first half of 2004 [1]. The most prevalent worms were variants of Netsky, MyDoom, Beagle, and Sober. In the 2005 CSI/FBI Computer Crime and Security Survey, 75 percent of the surveyed organizations reported being hit by worm and virus attacks [2]. Worms and viruses were the most frequent and costly type of attack, despite the use of antivirus software and firewalls by 96 percent of the surveyed organizations.

Analogies with biological disease, with topological considerations added, show that the spread of computer viruses can be contained.

Building on decades of research by mathematical epidemiologists, we have obtained some understanding of the factors that govern how quickly viruses spread. Our efforts to find efficient methods of detecting viruses and the relations among them owe much to pattern-matching techniques developed by computational biologists.

Despite serious concerns raised by the proven ability of computer viruses to spread between individual systems and establish themselves as a persistent infection in the computer population, there have been very few efforts to analyze their propagation theoretically. The strong analogy between biological viruses and their computational counterparts has motivated us to adapt the techniques of mathematical epidemiology to the study of computer-virus propagation. In order to allow for the most general patterns of program sharing, we extend a standard epidemiological model by placing it on a directed graph and use a combination of analysis and simulation to study its behavior. We determine the conditions under which epidemics are likely to occur, and in cases where they do, we explore the dynamics of the expected number of infected individuals as a function of time. We conclude that an imperfect defense against computer viruses can still be highly effective in preventing their widespread proliferation, provided that the infection rate does not exceed a well-defined critical epidemic threshold.

The Internet and the world wide web (WWW) play an ever greater part in our lives. Only relatively recently, however, have researchers begun to study how the patterns of connectivity in these networks affect the spread of computer viruses within them (1, 2) and their ability to handle perturbation or attack (3). Many models for communication can be formulated in terms of networks, in which nodes represent individuals (such as computers, web pages, people, or species) and edges represent possible contacts between individuals (network links, hyperlinks, social or sexual contact, and species interactions). The study of communication networks therefore has interesting parallels both with conventional epidemiology (4, 5) and with the ability of ecosystems to handle disturbances.

Recently there have been a number of news reports on computer "viruses." This column is intended to give you an understanding of viruses and the issues that they raise.

Students often perceive epidemiology as a dry subject and not relevant. These same students, also often, do not perceive themselves to be personally at risk of infection. To make the teaching of epidemiology more interactive and to graphically demonstrate the concept of risk, an experiential learning exercise was developed. The experience was designed so students would access a weekly computer quiz in the computer laboratory. One of the computers was "infected" with a silent computer virus (tagged file). Therefore, while answering questions, the students exposed their disks to an infection, which was transmitted to other computers and disks. At the end of the term, the spread of infection throughout the class was monitored by identification of infected disks and computers. Explaining the infection which had been passed throughout the class facilitated a discussion of epidemiology and risk assessment. Students were surveyed to assess their response to this exercise which was found to be extremely favorable.

By comparing worms that propagate over the networks, we can learn about the threats to our computing communities. These worms take advantage, of operating system features as well as holes. They provide an adversary with both a denial of service weapon, as well as a means of gathering information. They can be studied with techniques developed for medical epidemics.

Recent malware epidemics proved beyond any doubt that frightful predictions of fast-spreading worms have been well founded. While we can identify and neutralize many types of malicious code, often we are not able to do that in a timely enough manner to suppress its uncontrolled propagation. In this paper we discuss the decisive factors that affect the propagation of a worm and evaluate their effectiveness.