Информатички технологии

COMMON DEFENSES. The anti-virus technologies differ in their effects on viral birth and death rates.

The virus scanner, the most common, works by examining stored programs for infection with one of a set of known viruses. Scanners often also detect slight variants of know viruses. Some even incorporate a heuristic function, which allows them to detect some brand-new viruses by guessing at the function of the code.

Scanners excel at raising the virus death rate. Someone who installs a scanner and uses it at regular intervals -- say, once a week -- increases the death rate from nearly zero to at least, in this case, once a week. A resident scanner, which is always active in the system examining all programs that are loaded, pushes the death rate even higher, since the virus is detected (an presumably removed) as soon as it is loaded.
Scanners can also act as filters to decrease the viral birth rate. For example, if all new programs arriving at a machine are scanned as they arrive, the effective birth rate of the machine's neighbors will be lower.

Traditional access control systems are a second kind of anti-virus technology. By preventing unauthorized programs from altering other programs, they can decrease the viral birth rate. Networked systems lacking access control could be swamped by a virus within an hour or two. In his early experiments, however, Cohen showed that even when access controls are in place, viruses can spread quickly and widely without violating those controls.

A third anti-virus technology, sometimes called integrity management, lies somewhere between scanners and access control systems. Its strategy is to detect and prevent virus spread by noticing or preventing the changes viruses make to parts of the computer system. An integrity management system can increase the viral death rate if it notices an anomaly due to a virus and alerts the user. Conversely, the system may note but not warn the user of a change (perhaps because the virus has noticed the protection and has not tried to spread), in which case it is limiting the birth rate.

While scanners work best against known viruses, integrity management systems can guard against larger classes of viruses. Because they look for general methods that viruses use to spread, not for the bit patterns that make up the virus code, they can be more effective on newly devised infectors. Their disadvantage is that they also flag or prevent legitimate activity, and so can disrupt normal work or lead the user to ignore their warnings altogether.
...