VX Heavens

Library Collection Sources Engines Constructors Simulators Utilities Links Forum

The results of the Contest for the Best Virus Definition in technical categories

Suzana Stojakovic-Celustka
Alive Vol I, Issue 0
March 1994

[Back to index] [Comments (0)]

The members of jury for the first two categories from Contest for the Best Virus Definition (1. Technical definition in plain language, 2. Mathematical technical definition) were:

  1. Vesselin Bontchev, VTC Hamburg, Germany e-mail bontchev@informatik.uni-hamburg.de
  2. Anthony Naggs, consultant, UK e-mail amn@ubik.demon.co.uk
  3. Yaron Goland, U.C.L.A, USA e-mail ygoland@SEAS.UCLA.EDU
  4. Roberto Reymond, IBM C.E.R.T., Italy e-mail rreymond@vnet.IBM.COM

The guidelines were:

  1. Technical definition (in plain language - preferably English)

    The definition should be concise, without reference to the user's state of mind and free of value judgements, e.g. "good", "bad", "beneficial". The definition should be unambiguous, and include a statement of the environment to which it applies, (e.g. the operating system).

  2. Technical definition (mathematical)

    The meaning of every symbol in mathematical formula(s) should be clearly explained.

The jury used the following evaluation scale:

  1. useless
  2. has serious problems
  3. must be improved
  4. good enough
  5. very good
  6. excellent

Results in category 1.: Technical definition in plain language

1. Author: William Walker

Submitted by: author

Source: Contest posting

English language definition of a computer virus

A "COMPUTER VIRUS" is a sequence (or set of sequences) of symbols which, when executed or interpreted under certain conditions or in certain environments, will make a possibly altered, functionally similar copy of this sequence (or set of sequences) and will place this copy where it will intercept execution or interpretation at a later time under certain conditions. This is called "REPLICATION," and the copy retains AT LEAST the capability to recursively replicate further. A virus may also have an additional function (or functions) not related to replication, sometimes called a "payload," but this is NOT necessary for something to be a virus.

Comments on the above definition:

  1. This definition is not tied to any specific machine or operating system. The phrase "sequence of symbols" is used rather than "sequence of instructions" or "program" to help keep the definition as generic as possible.
  2. A computer virus may not be restricted to a single sequence of symbols, but may consist of two or more sequences that individually do not constitute a virus, but working together satisfy the criteria of being a virus.
  3. The phrase "intercept execution or interpretation" refers to the fact that a computer virus must somehow be placed on a host machine where it will be executed or interpreted in order to survive. This is done by forcing the host machine to execute or interpret the virus before, during, after, or instead of some other sequence of symbols on that system; in other words, "intercept execution or interpretation."
  4. "Replication" (or "spreading"), as defined above, is the key point in defining a computer virus. A sequence of symbols which does not replicate cannot be a virus. Likewise, every virus must replicate, or it is not a virus. On the other hand, the inclusion of a "payload" is not essential for something to be a computer virus.

Jury's decision : 4 (good enough)

2. Author: Vesselin Bontchev

Submitted by: Suzana Stojakovic-Celustka

Source: e-mail conversation

A computer virus is a sequence of symbols, which, when interpreted by computer, attaches itself to other computer interpretable symbol sequences in such a way that they become able to recursively spread the (possibly modified) initial sequence further.

Additional explanations of used terms:

"Infection" is the process of attaching a computer virus to other computer interpretable symbol sequences.

"Attaching" means that the interpretation of the infected symbol sequences causes the interpretation of (possibly part of) the computer virus.

"Interpretable" is anything that a computer can interpret.

"Able to spread recursively" means when a virus infects an executable object, this object is able to spread virus to another object, which in turn is able to cause the infection of another object and so on.

Jury's decision: 3 (must be improved)

3. Author: Fred Cohen

Submitted by: Suzana Stojakovic-Celustka

Source: Article "Computational Aspects of Computer Viruses", Computers & Security, 8 (1989.), pp 325-344

We informally define a "computer virus" as a program that can "infect" other programs by modifying them to include a, possibly evolved, copy of itself. With the infection property, a virus can spread throughout a computer system or network using the authorizations of every user using it to infect their programs. Every program that gets infected may also act as a virus and thus the infection spreads.

Jury's decision: 3 (must be improved)

4. Author: Greg Hale

Submitted by: author

Source: Contest posting

For a program to qualify as computer virus, the program must meet two qualifications:

  1. The virus must replicate itself and all subsequent reproductions (exempting unsuccessful infections) must be able to replicate.
  2. The virus must execute by replacing or redirecting the user's request for the computer to start the normal operating system or execute a familiar program.

Jury's decision: 3 (must be improved)

5. Author: Roberto Reymond

Submitted by: author

Source: Contest posting

A set of instructions that, once executed or interpreted, gains the control of the environment.

That done, those instructions will, in specific circumstances, make at least one copy of the initial set, identical or modified, placing it/them somewhere in the environment, with the intention that, if and when executed or interpreted, it/they will repeat at least one time the above cycle.

Additional explanation of terms:

Environment: it means the whole system, that is the combination of all the hardware (fixed and removable) and the software presents at the moment of the virus actions.

Jury's decision: 3 (must be improved)

6. Author: Fred Cohen

Submitted by: author

Source: Contest posting

A program that reproduces.

Jury's decision: 2 (has serious problems)

Results in category 2.: Mathematical technical definition

1. Author: Fred Cohen

Submitted by: Vesselin Bontchev

Source: Short article "Formal Definition" written by Vesselin Bontchev, based on private discussion with the author

(The contribution is not presented here, because of mathematical symbols).

As in this category were no other contributions, this one was considered as a winner without jury's voting.

Editor's note

Either the jury was too severe or plain language is not suitable to define computer virus properly. The winning definition is evaluated as "good enough" only. The others must be improved. However, it seems that the key point in defining a computer virus is a "replication" (as stated by W. Walker). Personally, I found comment 2. in W. Walker's definition very interesting for possible future development of computer viruses.

"A virus is a virus!"

- Nobel laureate Andre Lwoff's answer on the question "What is a virus?" (1959.)

[Back to index] [Comments (0)]