4.3- The Michelangelo Effect
The anomalous peaks in
Figs. 9 and 10 in early 1992
require an explanation.
Our data collection was strongly perturbed during that time by a very peculiar event:
Michelangelo Madness
Figure 11 shows the number of observed incidents during
two-week periods in 1992 for the Michelangelo and Stoned viruses, and for the
total over all viruses except for these two. A quick glance shows that all three
trends have approximately the same shape: a sharp rise to a peak on the two-week
period ending on March
Figure 11: Number of virus incidents reported per 1000 PCs for Stoned, Michelangelo, and all other viruses during two week periods ending with the indicated date. The dashed line indicates the incident rate for all viruses other than Stoned and Michelangelo during the fourth quarter of 1991 (normalized to a two-week period by multiplying by  ).
This behavior is completely at odds with the behavior in Figs. 9 and 10, in which dynamical trends occurred on much slower time scales. Furthermore, it is difficult to believe that the actual incident rate of Michelangelo, Stoned, and the sum total of all other viruses just happened to undergo a huge fluctuation in unison.
There is a simple explanation. In fact, the actual incident rate
was not fluctuating as wildly as the observed incident rate shown in
Fig. 11.
We can surmise from this data that,
about a week or two before March
In slightly different terms, our usual assumption that the observed incident rate lags the actual incident rate by some constant amount (the average incident duration) broke down for the first time due to a sudden, pervasive, but temporary alteration in user behavior during late February and early March of 1992. We are currently trying to refine the theoretical analysis presented in Section 3.2.1 in order to help disentangle two effects:
If we succeed, we will be able to determine the extent to which the
world's computer virus population was set back by Michelangelo. In addition,
we may be able to estimate the average lag time Q, and
hence
In the aftermath of Michelangelo, the equilibrium level of infection for common viruses such as Stoned and 1813 appears to have dropped significantly (Fig. 9), as has the total virus incident rate (Fig. 10). Michelangelo Madness had a salutary effect on the world's virus population, perhaps reducing it by a factor of two overall. However, one would wish that this reduction had been achieved by more orderly, less costly means. We believe that our two-pronged (statistical and mathematical) epidemiological approach can help us devise more sensible ways to achieve even more dramatic reductions in worldwide virus prevalence.
|
, followed by a dip that bottoms out during April and
a gradual recovery towards the rate that prevailed at the beginning of the year.
(the date on which
Michelangelo was slated to damage the file system on hard disks), many users both
inside and outside our sample population decided to scan their disks
because they were concerned about being infected with Michelangelo.
Since incidents were discovered sooner than they ordinarily
would have been, there was a short-lived but dramatic peak in the observed
incident rate. This depleted the reservoir of infection in our sample population,
resulting in a noticeable dip in the observed infection rate during April, by which
time the scanning rate had most likely returned to normal. This also
explains the similarity in shape of the three curves in Fig. 
and
for several of the most prevalent viruses.