An Epidemiological View of Worms and Viruses

1. Introduction The communal nature of the Internet exposes organizations and home computer users to a multitude of worms, viruses, and other malicious software (malware) threats such as spyware and Trojan horses. Viruses are program fragments attached to normal programs or files that hijack the execution control of the host program to reproduce copies of the virus. Worms are automated self-replicating programs that seek out and copy themselves to vulnerable new targets over the Internet. In the same way that germs are quickly shared among people, worms can spread rapidly among networked computers. In the second half of 2004, Symantec reported 7,360 new Windows worms and viruses, an increase of 63 percent over the number of new worms and viruses in the first half of 2004 [1]. The most prevalent worms were variants of Netsky, MyDoom, Beagle, and Sober. In the 2005 CSI/FBI Computer Crime and Security Survey, 75 percent of the surveyed organizations reported being hit by worm and virus attacks [2]. Worms and viruses were the most frequent and costly type of attack, despite the use of antivirus software and firewalls by 96 percent of the surveyed organizations. Biologists tackle infectious diseases at both microscopic and macroscopic levels. However, very little effort is spent to treat worms and viruses at the macroscopic or epidemiological level. Today the security industry focuses on the treatment of worms and viruses exclusively at the " microscopic " level, analogous to the microbiological approach to infectious diseases. Antivirus companies collect samples of worms and viruses through donations and honeypots. The malicious code is disassembled into a more human readable format to study its programmatic structure and develop a new antivirus signature. The new signatures are downloaded to update antivirus software programs. Epidemiology is more interested in the dynamics of diseases spreading through populations than their biochemical mechanism. In the long history of medicine, epidemiology has been a relatively recent development. The foundations of epidemiology are often traced to Dr. John Snow who studied an outbreak of cholera in London in 1848 [3]. In treating patients, he became convinced that the disease was spread by ingesting germs from polluted water. At the time, many physicians did not believe in germs as the cause of infectious diseases. To avoid controversy, Snow described the cause of cholera as a " poison " that had the ability to " multiply itself " within cholera victims, before being …