13 May 2002 Physics Letters A 297 (2002) 261–266 www.elsevier.com/locate/pla A unified prediction of computer virus spread in connected networks Lora Billings a,∗ , William M. Spears b , Ira B. Schwartz c a Department of Mathematical Sciences, Montclair State University, Upper Montclair, NJ 07043, USA b Department of Computer Science, University of Wyoming, Laramie, WY 82071, USA c Naval Research Laboratory, Nonlinear Dynamics System Section, Code 6792, Plasma Physics Division, Washington, DC 20375, USA Received 8 November 2001; received in revised form 5 February 2002; accepted 5 February 2002 Communicated by C.R. Doering Abstract We derive two models of viral epidemiology on connected networks and compare results to simulations. The differential equation model easily predicts the expected long term behavior by defining a boundary between survival and extinction regions. The discrete Markov model captures the short term behavior dependent on initial conditions, providing extinction probabilities and the fluctuations around the expected behavior. These analysis techniques provide new insight on the persistence of computer viruses and what strategies should be devised for their control.  2002 Elsevier Science B.V. All rights reserved. PACS: 07.05.Tp; 02.30.H; 02.50.Ga Keywords: Computer virus; Markov models; Differential equation models Concerns about our vulnerability to computer virus- es have prompted a serious effort to model their spread, and to develop a detection and control mecha- nism that prevents widespread infection of computers connected to the internet. Because of the widespread connectivity of the internet, there has been much at- tention paid to the organization and transmission of in- formation on finite networks. One such example is the small-world network [1], where a regular network is combined with a few random interconnections. Sim- ilar models have generated statistical cluster analysis * Corresponding author. E-mail address: billingsl@mail.montclair.edu (L. Billings). URL address: http://www.csam.montclair.edu/billings . based on percolation [2], scaling laws [3], and control of information [4]. Recent work on internet connectiv- ity has shown that with the right scaling law, the in- ternet is robust when computer attacks remove certain nodes [5]. Moreover, percolation theories have been used to model the propagation of an epidemic proba- bilistically [6]. Recently, traditional biological approaches have been combined with topological interconnects, such as small-world networks [1,7], percolation theory, and graph theory, to predict the conditions for which an epidemic will occur [8]. Examples are discrete algo- rithms based on Markov models and continuous or- dinary differential equation models derived from epi- demic compartmental models based on large popula- tions [9]. In this Letter, we derive a Markov and an 0375-9601/02/$ – see front matter  2002 Elsevier Science B.V. All rights reserved. PII:S0375-9601(02)00152-4