Team Number: 054
School Name: Sandia Preparatory School
Area of Science: Computer Security
Definition of Problem:
In 2002 the number of known computer viruses surpassed 70,000 (www.securitystats.com). “It is difficult to evaluate anti-virus systems, since they work in the wild and few companies would be willing to turn off their anti-virus software to be part of a control group” (An epidemiological model of virus spread and clean up from HP). One of the most important parts of the detection and analysis of viruses is the way that they spread from computer to computer. If an accurate model of the spread of viruses can be created that would keep track of the amount of the time it takes for an anti-virus company, like Norton, to create a definition of the virus and distribute it to all of its uses, it will be easier to create a temporary stopgap measure that may help keep viruses from infiltrating a network, or perhaps find a way of identifying new kinds of viruses based on the pattern of its distribution.
“…The word virus is used to denote any malicious code. These codes fall into three main categories, namely virus (in technical sense), Trojan horses, and worms” (An Epidemiological Model of Computer Virus Spread and Countermeasures).
Plan of How to Utilize Computers to Solve the Problem:
Using C++ it is possible to create a program, using an already created program by HP as a base, that will create an on the fly model of how the virus circulates and allow us to manipulate the time needed to create an anti-virus definition and distribute it. The model is based on the premise of how the average virus is spread:
Based on the order in An epidemiological model of virus spread and clean up from HP:
Our goal is to use a computer or cluster node to create a model or graph of how the virus spreads initially and then monitor how long it takes to purge all, or most of, the computers of the virus. Note: no ‘live’ viruses are used in this model. “The machines (in the model) move between four states:
(An epidemiological Model of Computer Virus Spread and Countermeasures).
To date, a basic program based on earlier models has been written in C++ to model the spread and detection of a virus using a system of variable parameters. The computers are given possible statuses of susceptible, infected, and detected. The probability of any given computer entering one of these classes is directly relative to the category before in the form of a very basic Markov chain, which, at this point, is little more than moving from susceptible to infected to detected over a given period of time.
Our team continues to work with Eric DeBenedictis of the Red Storm Project at Sandia Laboratories, who is our primary human resource on viruses, and Edward Bedrick of the University of New Mexico Statistics department, our resource on the statistics involved in our project. We are at present devising a new direction to take the project in which would add an element of supercomputing to the basic program already written.
In a final prototype, we hope to fashion a simulation of the possible spread of multiple viruses through a system of computers using differently valued parameters for each and subjecting new ones such as unsusceptible and infected but dormant. A likely path for our enhanced simulation is currently in the realm of e-mail viruses, which may be given the additional stricture of whether the viral e-mail is opened or not. The final make-up of these additions however remains to be seen.