Slashdot Mirror

← Back to Stories (view on slashdot.org)

Assessing Internet Viruses Like Human Epidemics

Posted by ryuzaki0 on from the beating-the-spread dept.

underpar writes "This ComputerWorld.com article discusses the UCSD's $6.2 million attempt to study Internet viruses in a manner similar to the study of human epidemics. Stefan Savage, a computer science professor, is quoted in the article as saying, 'We'll be focused on what vectors are used, just like in assessing West Nile, to spread computer viruses and ultimately try to develop defenses to prevent them from spreading.'"

8 of 171 comments (clear)

  1. Interesting Academic Exercise by tony3w · · Score: 5, Interesting

    This is an interesing academic exercise, but the basic defenses that have been preached for years work just fine:

    - Avoid IE for surfing
    - Avoid OL/OE for eMail
    - Firewall (in and out) all OSes with large numbers of exploitable bugs
    - Automate patching
    - Warn on Anomolous behavior
    - Have a virus scanner that is up to date

    I don't even rely on the last one and I've been virus free for the past 9 years!

  2. Re:Hasn't this been done before? by hashish · · Score: 5, Interesting

    Yeah, and this does miss some points. Viruses in humans can mutate and attach themselves to other viruses. Until a computer virus does this they eventually die out when the PC gets patched.

    But i guess it was fun for someone to do...

  3. The computer-organism paradigm doesn't work by mark-t · · Score: 4, Interesting
    Because living organisms are more or less static, and if it weren't for evolution, would be completely unchanging. Living organisms can defend against viruses reasonably well because they know what they are and can therefore easily recognize anything that doesn't match that, and just go bezerk on it.

    Desktop computers, on the the other hand, are not static systems at all. So there's no really good way for a system to differentiate what's not really supposed to be there from something that was deliberately put there by the user. As I said, this isn't a problem for a living organism because that's a closed system, and anything new that gets put into it, without suitable precautions taken beforehand, will be attacked by the body's defenses as a foreign invader. Such a mechanism implemented on a desktop computer would render the computer practically useless for anything that we take for granted that programmable computers do today.

    --
    File under 'M' for 'Manic ranting'
    1. Re:The computer-organism paradigm doesn't work by Qzukk · · Score: 4, Interesting

      So there's no really good way for a system to differentiate what's not really supposed to be there from something that was deliberately put there by the user.

      Thats not a good way to categorize things, given the number of malware and trojans "deliberately" installed by the user. Rather, we should identify the malware based on its behavior: Does it alter other executables not installed with it? Does it connect to one site repeatedly? Many sites rapidly? Does it attempt to access the addressbook? Mail itself out? Make multiple copies of itself in the windows directory? Edit registry settings it doesn't create? Remove or replace other files that weren't installed with it? And so on...

      Once we look at it that way, its fairly simple to identify malware as its operating, and once its identified, the cleanup process can begin.

      --
      If I have been able to see further than others, it is because I bought a pair of binoculars.
  4. OK, let's go with this by bigberk · · Score: 4, Interesting

    In a biological system (an ecosystem) you want a large diversity of species participating in the system, so that environmental fluctuations and pathogens don't wipe out large parts of the ecosystem all at once.

    If you extend this to interoperating computer systems, then ideally you want a variety of platforms (indeed, operating systems but also processor architectures and device types).

  5. Re:Hasn't this been done before? by Mshift2x · · Score: 5, Interesting

    Yes. This has been done before. We've done this in our calclulus class. We've used a program to map the 'lifecycle' of a virus. First numerous vulnerable PCs, the way in which they spread to eachother, new vulnerable computers being connected to the internet, patching of the computers. It was all pretty cool stuff.

  6. Re:Hasn't this been done before? by darkain · · Score: 5, Interesting

    polymorphic code

  7. Difference between computers and organisms: by cr0z01d · · Score: 5, Interesting

    Organisms can die from diseases. A virus won't destroy a computer, the worst case scenario is a wipe and fresh install. This means that Microsoft can make their software bug-ridden.

    Maybe if viruses were to fry hardware, we could see some improvements.