恶意软件流行病的初始增长率无法预测其影响范围
Initial growth rates of malware epidemics fail to predict their reach
摘要：
实证研究表明，基于流行病初始传播率的流行病模型往往无法预测该流行病的真实规模。大多数流行病在早期迅速上升，在影响到相当大一部分人口之前就已经消亡，而有些流行病的早期速度相当缓慢。最近的模型表明，这可能是由于目标人群的易感性的异质性。我们研究了一个计算机恶意软件生态系统，展示了类似于生物系统的传播机制，同时提供了人类流行病无法提供的细节。我们没有比较模型，而是直接从一个平行领域的新的、更完整的数据中估计影响范围，这些数据提供了关于生物爆发的更好的细节和见解。我们发现一个高度异质性的分布的计算机兼容性，几乎所有的爆发最初过度影响分布的尾部，然后迅速崩溃，一旦这条尾巴被耗尽。这一机制限制了流行病的初始增长率与其总影响范围之间的相关性，从而防止了大多数流行病，包括最初快速增长的爆发，影响到人口的宏观比例。少数几个普遍存在的恶意软件通过以下关键特征在早期区分自己：它们避免感染尾部，同时优先针对不受典型恶意软件影响的计算机。
英文摘要：
Empirical studies show that epidemiological models based on an epidemic's initial spread rate often fail to predict the true scale of that epidemic. Most epidemics with a rapid early rise die out before affecting a significant fraction of the population, whereas the early pace of some pandemics is rather modest. Recent models suggest that this could be due to the heterogeneity of the target population's susceptibility. We study a computer malware ecosystem exhibiting spread mechanisms resembling those of biological systems while offering details unavailable for human epidemics. Rather than comparing models, we directly estimate reach from a new and vastly more complete data from a parallel domain, that offers superior details and insight as concerns biological outbreaks. We find a highly heterogeneous distribution of computer susceptibilities, with nearly all outbreaks initially over-affecting the tail of the distribution, then collapsing quickly once this tail is depleted. This mechanism restricts the correlation between an epidemic's initial growth rate and its total reach, thus preventing the majority of epidemics, including initially fast-growing outbreaks, from reaching a macroscopic fraction of the population. The few pervasive malwares distinguish themselves early on via the following key trait: they avoid infecting the tail, while preferentially targeting computers unaffected by typical malware.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
