A model for studying the spread of computer viruses

Abstract

Lillie or no data exists on the spread of computer viruses. It is unethical to release even a controlled virus and monitor its activity since that virus, while it is active, steals CPU cycles and storage space from an unknowing participant. Another avenue of study is to model a computer environment and simulate the model. The simulated model can then be studied without the undesirable side effects of a real virus. The model can also be used to gauge the vulnerability of computer systems to viral infections as well as to provide a means for determining preventative measures against viral infections. The model implemented consists of a college computer center and the activities that take place around the computer center. A virus is released into the modeled computer center, and the effects arc observed. The modeled computer center accommodates Five types of users: students, majors, graduate students (grads), faculty, and system managers. The model contains a set of general purpose microcomputers for students, majors, and grads. Each microcomputer has two floppy disk drives and a connection to a central file server. Access to the file server is controlled. Each user type can have read, rcad/writc, or no access to the file server node. The model provides each faculty member and system manager with a microcomputer that is networked to the file server node and is equipped with a hard disk drive. All users have their own personal set of diskettes. A typical user's activity is modeled in the following manner. Users enter the computer center, choose what media they need to access (file server, personal diskettes, etc.), and perform transactions. A transaction can be copying a program, deleting a program, or executing a program. At some point in lime, a virus is introduced. When an infected program is executed, the virus seeks out and infects an eligible program (or programs). The spread of the virus is monitored. Up to three viruses can be introduced at various times. The initial infection occurs on a diskette, a hard drive, or the file server. If two different viruses infect the same program, only the most recent infection is active. Robert P. Trucbloocl Departm ent o f Com puter Science U niversity o f South Carolina Colum bia, South C arolina 29208 After an infected program is executed a given number of times, the virus has the option to trigger (i.e., become active). A triggered virus lias the option to do one of three things. It can delete one program, delete all programs on a diskette, or delete all programs on a hard drive or file server. After a given period of time, llic virus has the option to deactivate and the next lime (lie host program is executed, the virus removes itself from the program. Users also can copy or delete programs. When users copy programs, they can copy the program to themselves or to a friend. Each user has a clique of friends. When users are Finished with the computer, they sign off and leave the computer center. This model was simulated in Turbo Pascal on an IBM AT running MSDOS. A more detailed description of the model and its implementation is given in [1]. Seventeen different sets of parameters must be set before the simulation begins. Values for these parameters were obtained from data gathered from the computing facility at Coker College in Ilartsvillc, South Carolina. The simulator can be used to help answer several questions. For example, what effects do restricting access to the File server node have on the spread of a virus? A more general question might be: what effects do different topological paths of infection have on the spread of a virus? Another possible use of the simulator is Finding a way to help slow or stop the spread of viruses. If the main factors affecting the spread of computer viruses can be determined, measures can then be taken to slow or slop the spread of viruses. REFEREN CES 1. Harris, J.K., and Trueblood, R.P., "A Description of a Model for Studying the Spread of Computer Viruses," Tech. Report No. TR90002, Department of Computer Science, University of South Carolina, Columbia, South Carolina 29208 (1990). Permission lo copy without fee all or port of this material is granted provided that the copies arc not made or distributed for direct com* merciol advantage, the ACM copyright notice and the title of tlie publication and its date appear, and notice Is given that copying is by permission of the Association for Computing Machinery. To copy otherwise, or to republish, requires a fee and/or specific per­ mission.