论文标题
恶意软件流行病的初始增长率无法预测其影响力
Initial growth rates of malware epidemics fail to predict their reach
论文作者
论文摘要
实证研究表明,基于流行病的初始扩散率的流行病学模型通常无法预测该流行病的真实规模。大多数流行病的早期增长迅速就消失了,在影响大量人群的大部分之前,而某些大流行的早期速度相当谦虚。最近的模型表明,这可能是由于目标人群敏感性的异质性。我们研究了一个计算机恶意软件生态系统,表现出类似于生物系统的传播机制,同时为人类流行病不可用的细节提供了细节。我们没有比较模型,而是直接从平行领域的新的和更完整的数据中估算出覆盖范围,而是作为生物暴发的关注点提供了较高的细节和见解。我们发现计算机敏感性的高度异质分布,几乎所有爆发最初都会过度影响分布的尾巴,然后一旦尾巴耗尽了,迅速崩溃了。这种机制限制了流行病的初始增长率与其总覆盖范围之间的相关性,从而阻止了大多数流行病,包括最初增长的爆发,无法达到人口的宏观分数。少数普遍的恶意软件在以下关键特征上很早就与众不同:它们避免感染尾巴,同时优先针对不受典型恶意软件影响的计算机的目标。
Empirical studies show that epidemiological models based on an epidemic's initial spread rate often fail to predict the true scale of that epidemic. Most epidemics with a rapid early rise die out before affecting a significant fraction of the population, whereas the early pace of some pandemics is rather modest. Recent models suggest that this could be due to the heterogeneity of the target population's susceptibility. We study a computer malware ecosystem exhibiting spread mechanisms resembling those of biological systems while offering details unavailable for human epidemics. Rather than comparing models, we directly estimate reach from a new and vastly more complete data from a parallel domain, that offers superior details and insight as concerns biological outbreaks. We find a highly heterogeneous distribution of computer susceptibilities, with nearly all outbreaks initially over-affecting the tail of the distribution, then collapsing quickly once this tail is depleted. This mechanism restricts the correlation between an epidemic's initial growth rate and its total reach, thus preventing the majority of epidemics, including initially fast-growing outbreaks, from reaching a macroscopic fraction of the population. The few pervasive malwares distinguish themselves early on via the following key trait: they avoid infecting the tail, while preferentially targeting computers unaffected by typical malware.