IEEETRANSACTIONSONSYSTEMS,MAN,ANDCYBERNETICS—PARTB.pdfVIP

IEEE TRANSACTIONS ON SYSTEMS, MAN, AND CYBERNETICS—PART B: CYBERNETICS, VOL. 34, NO. 2, APRIL 2004 823 The Impact of Countermeasure Propagation on the Prevalence of Computer Viruses Li-Chiou Chen, Member, IEEE, and Kathleen M. Carley Abstract— Countermeasures such as software patches or dollars per organization, 90% of which have installed antivirus warnings can be effective in helping organizations avert virus software. ICSA Survey [13] reports that virus infections have infection problems. However, current strategies for disseminating caused server down time, loss of productivity and loss of data for such countermeasures have limited their effectiveness. We propose a new approach, called the Countermeasure Competing (CMC) organizations, 92% of which have installed antivirus software. strategy, and use computer simulation to formally compare its rel- This evidence implies that installing antivirus software alone ative effectiveness with three antivirus strategies currently under cannot resolve the computer virus infection problem effectively consideration. CMC is based on the idea that computer viruses unless such software is implemented in the context of a more and countermeasures spread through two separate but interlinked comprehensive security strategy. If virus countermeasures, such complex networks—the virus-spreading network and the counter- measure-propagation network, in which a countermeasure acts as as software patches or new virus definition files, have not been a competing species against the computer virus. Our results show installed on vulnerable computers, these computers can still be that CMC is more effective than