2- Epidemiological Models
In our modeling of computer virus
spread [6, 7], we have borrowed
some important concepts and simplifications from the
well-established field of mathematical epidemiology [8]
In particular, we ignore the details of infection within
an individual (in our case, a computer system, along with
all associated storage media), considering it to be
in one of a small number of discrete states, such as
infected or susceptible. Furthermore, we
ignore the details of how disease is transmitted among
individuals. We assume that, from time to time, individuals
have ``adequate contacts'' with one another,
resulting in transmission of the disease if one individual
is infected and the other is susceptible. The details of what
constitutes adequate contact vary from one disease (or
computer virus) to another, but we simply assume that the
total rate of adequate contacts between one individual
and the rest of society is
For computer viruses, the rate of adequate contact
In addition to borrowing ideas from mathematical epidemiology, we have extended it by incorporating topological effects which turn out to be quite important [6, 7]. In the homogeneous mixing assumption, every individual in the population is assumed to be equally likely to infect or to be infected by every other individual. Our work has shown that this approximation works well when each individual has many randomized contacts with others. However, if the number of contacts that a typical individual has with others is fairly small and/or the pattern of contacts is more or less localized, the approximation fails terribly. We suspect that the majority of today's computer populations are characterized by a degree of sparsity and locality that invalidates the homogeneous mixing approximation. Figure 1 exemplifies a situation in which individuals (represented by nodes in the graph) are connected in both a sparse and a local manner. It can be thought of as representing a likely scenario in which workers within one group exchange software frequently among themselves, somewhat less frequently with other members of their department, and even less frequently with users in other companies, universities, or countries. The resulting topology contains random hierarchically-nested clusters with occasional cross-links. It is said to be sparse because each individual has adequate contacts (represented by edges of the graph) with just a few others. In other words, the average degree of the nodes in the graph is some small constant independent of the size of the graph. It is said to be local because, if nodes B and C are neighbors of (i.e. connected to) A, the probability for B and C to be neighbors is significantly enhanced over what it would be in a random graph.
Figure 1: Snapshot of viral-spread simulation running on sparsely-connected, hierarchically-clustered topology. Each individual, represented by a node, has adequate contact with an average of three others. White and black nodes represent uninfected and infected individuals, respectively. The pattern of exchange is fairly localized, and therefore so is the pattern of infection.
By analyzing and simulating viral spread on a variety of topological
structures, we have reached the following
conclusions
|
. We also assume that
there is some death rate
at which the individual is cured of
the infection 
. When
(
),
the system is above the ``epidemic threshold'', and
an epidemic occurs with probability
. If
it does occur, the number of infections increases exponentially
(
), eventually saturating at an equilibrium
of
, where N is the number of nodes.
Below the epidemic threshold (
;
), small outbreaks
may occur whenever the disease is introduced into the population, but
they can not be sustained for long.
is diminished to some value
less than 1. As the average degree of nodes in the graph diminishes,
so does
).
Even when an epidemic does occur, the growth rate is slowed, and the
equilibrium level of infection depressed below what it would be in
the corresponding homogeneous system.