Computers and Epidemiology

Worms and viruses have been at an intersection between computer networking and epidemiology for a number of years. The models are fundamentally similar, but they differ in a key way: if I'm sick, I have to make contact with a person to infect or at least travel through a similar space in a time window to pass on my germs. A computer can rapidly infect hosts around the world, randomly, in a very narrow time window, without everyone being physically close. This is a key paper to read and appreciate if you want to start thinking about worms from an epidemilogical stance.

Today, computer virus epidemiology is an emerging science that reveals that protective measures are definitely within reach of individuals and organizations. Among its findings:

• Computer viruses are far less rife than many have claimed. The rate of PC-DOS virus incidents for medium-sized to large businesses in North America appears to be about one per 1000 PCs per quarter. And fewer machines are caught up in a typical incident if anti-virus measures are in place.
• Few PC-DOS viruses have thrived. Less than 15 percent of the more than 1500 known viruses have ever been observed in a large sample population and most of them only once. The top 10 viruses account for two-thirds of all incidents.
• Because software and diskette sharing tends to be localized, even successful viruses spread at nowhere near the exponential rate that some have claimed. This is good news for the anti-virus industry, which otherwise would have to distribute its software updates even more often.
• Centralized reporting and response within an organization is an extremely effective defense. These policies have more than halved the average incident size within the population monitored by IBM Corp., and can eliminate chronic infections that may afflict even conscientious organizations.

Source: Computers and Epidemiology, Jeffrey O. Kephart, David M. Chess, Steve R. White. Published in the IEEE SPECTRUM, May 1993.