Note. The text below is part 6 of the paper titled "Epidemiological Modeling of Computer Virus Propagation."
This paper discusses a few simple epidemiological models that exist. The first is the Susceptible-Infected (or SI) model. Noticeably, there are two classes of individuals in this model: the susceptible class S (who are able to catch the disease) and infected class I (who aside from carrying the disease are also infectious) 13.
The SI model describes the behavior of an infective disease in a constant population of individuals which for simplicity ignores spatial variations14. The flow of the members is unidirectional from S to I. That is, an S member gets and remains infected. This scenario parallels the spread of either a new virus for which there is no antivirus yet. In this situation, all susceptible S members shall become infected I members in a matter of time.
The second is the Susceptible-Infected-Removed (or SIR) model which was developed by Kermack and others in 1927. With the addition of removed R class, it is evidently an extension of the SI model. In other texts, the R is referred to as the Recovered/dead class. This addition allows for the model to include deaths from infection which the SI model ignores15.
The flow of the members is again unidirectional from S to I and then to R. That is, an S member gets infected thus becoming an I member. If he/she gets cured or die, he/she then becomes an R member. Being unidirectional, an R member do not go back to being an S or I member again and I members do not go back to being S member again.
This scenario parallels the spread of computer virus where there is already an antivirus. By the contacts between I and S class computers, an S computer becomes infected. By the corrective action of the antivirus, the infected I computer becomes removed (or recovered) R computer. By the preventive action of the antivirus, the recovered R computer cannot become susceptible or infected again to the same virus.
The next is the Susceptible-Infected-Removed-Susceptible (or SIRS) model. The addition of the Susceptible S class after the removed R class is for situations where the computer becomes susceptible again to the same virus16. This happens when the antivirus that is supposed to immune a computer from the same virus was deleted or is not always kept running.
Last in this paper’s list of epidemic models applicable to spread of computer virus is the Susceptible-Exposed-Infected-Removed (or SEIR) model. In this model, the infected but not yet contagious E class members are added. This additional E class is for those where the contracted virus is still under incubation17.
In the computer virus epidemic, the concept of incubation is commonly found in such security threats as bombs. These are either event or time-activated threats which later will cause damage to programs and files. Although the activation is set in the future, these computers are nevertheless infectious. Unless destructive effects of virus are included in the study, the SEIR is not readily applicable. The presumption is that infected computers are immediately infectious.
There are more sophisticated epidemiological models applicable to computer virus propagation. Inasmuch as this paper aims to apply a few simple ones, the discussion of these models was not included here. This paper developed an SI and SIR models of the computer virus propagation.
13Christopher May, “Modelling a Computer Virus Epidemic” downloaded from maths.dur.ac.uk (April 30, 2009), 10.
14Christopher May, 11
15Daniel P. Maki, Mathematical Models and Applications (New Jersey: Prentice Hall, 1973), 359.
17Daniel P. Maki, 359.