School of Business Administration, Hebrew University of Jerusalem, Jerusalem, Israel.
Microsoft Research, Herzliya, Israel.
Sci Rep. 2021 Jun 3;11(1):11750. doi: 10.1038/s41598-021-91321-0.
Empirical studies show that epidemiological models based on an epidemic's initial spread rate often fail to predict the true scale of that epidemic. Most epidemics with a rapid early rise die out before affecting a significant fraction of the population, whereas the early pace of some pandemics is rather modest. Recent models suggest that this could be due to the heterogeneity of the target population's susceptibility. We study a computer malware ecosystem exhibiting spread mechanisms resembling those of biological systems while offering details unavailable for human epidemics. Rather than comparing models, we directly estimate reach from a new and vastly more complete data from a parallel domain, that offers superior details and insight as concerns biological outbreaks. We find a highly heterogeneous distribution of computer susceptibilities, with nearly all outbreaks initially over-affecting the tail of the distribution, then collapsing quickly once this tail is depleted. This mechanism restricts the correlation between an epidemic's initial growth rate and its total reach, thus preventing the majority of epidemics, including initially fast-growing outbreaks, from reaching a macroscopic fraction of the population. The few pervasive malwares distinguish themselves early on via the following key trait: they avoid infecting the tail, while preferentially targeting computers unaffected by typical malware.
实证研究表明，基于传染病初始传播速度的流行病学模型往往无法预测该传染病的真实规模。大多数早期快速上升的传染病在影响大量人群之前就已经消失，而一些大流行病的早期速度则相当温和。最近的模型表明，这可能是由于目标人群易感性的异质性所致。我们研究了一种计算机恶意软件生态系统，它展示了类似于生物系统的传播机制，同时提供了人类流行病无法获得的详细信息。我们不是比较模型，而是直接从一个新的、更为完整的数据集中估计影响范围，该数据集来自于一个平行的领域，提供了有关生物爆发的更好的细节和洞察力。我们发现计算机易感性的分布高度异质，几乎所有的爆发最初都会过度影响分布的尾部，然后一旦这个尾部耗尽，就会迅速崩溃。这种机制限制了传染病初始增长率与其总影响范围之间的相关性，从而阻止了大多数传染病（包括最初快速增长的传染病）达到人口的宏观比例。少数普遍存在的恶意软件通过以下关键特征早早地脱颖而出：它们避免感染尾部，而是优先针对那些不受典型恶意软件影响的计算机。
