Viral Warfare:
The search for a computer immune system
A paper by:
RAdm. RM Wey and Comm. DL Wey
COSR: SFS-SFC DCOSR: SFS-SFC
As computers grow in complexity, so too do the viruses which infect them. So much likened to the very viruses which plague many species, computer viruses replicate in much the same manner. By attaching themselves to their host[in this instance a program or actual machine],as would a virus of the biological kind, and subverting it to create copies of itself.
And like their biological counterparts, the effects to computer systems can sometimes prove fatal. To date, there are three main forms of virus: file infectors, boot sector viruses, and macro viruses. The greatest percentage of these are designed to infect the files of applications such as spread sheets and games. Such infections begin as the program is executed; Installing itself within the systems memory, it then begins to copy itself into every application run by the systems user.
A boot-sector virus[accounting for approximate one twentieth of all known viruses]is designed to reside in an area of a computers' system which contains the very operating system itself. Once there, such viruses can replicate to every application and storage device; As the virus is loaded into memory each time the system is turned on.
The third group, the macros, are the easiest to spread, as they are independent of the operating system, and therefore can do the most damage. Containing basic replication code, and whatever else the creator chooses, these viruses mutate depending upon the system.
Alas, the anti-viral technology is at present, limited as to the kinds of immunization it can offer. As pattern matching algorithms they can sort through many different signatures at one time, yet must be continually updated to be effective.
The two main ways a virus is removed once detected are: The complete removal of the program in question. And, the surgical removal of the infected area. While the first is not the best way, it does keep the system safe. The second method works because the virus must keep the original host program intact[in order to remain hidden and to replicate].
It is through these episodes that data is collected and used as a form of ‘medical dictionary,’ and by creating a program which contains every known virus and its cure, systems can be inoculated.
However, just as with biological entities, changes in a computers' environment can make such precautions mute; Yet by the same token, file infectors and boot-sector viruses have declined or been eradicated due to the changes in operating systems. Now, only the macro viruses remain a true threat.
By this we mean that as systems become more interdependent[through connections in the Internet, as well as through networks], macros spread in a predacious manner; Making the need for a more automatic response system all the more important.
The ‘Digital Immune System’ would be a proprietary system to which client systems would be connected[similar to the anti-viral software currently in use by most PC’s, but much more sophisticated]; As new software is introduced to the client system, it would be ‘scanned’ for all known viruses, and if infected, would be treated before introduction to the client system. If found clean, a snapshot would be taken and inoculations made.
Concurrently, samples of the viruses found would be studied and procedures found to recognize the virus. It would then be ‘added’ to the directory of known viruses. Alas, as with the biological systems, computer systems will[for the foreseeable future]be plagued by the existence of viruses, and only through diligence will be able to survive.