ÎçÒ¹¸£Àû1000¼¯ºÏ

Computers could soon fight off viruses that attack them by using an
in-built ‘imm-une system’. For a user, this should mean that systems will
no longer be immobilised for hours or days, but instead will fight the virus
while performing other functions.

Existing antivirus programs are generally managing to stay one byte
ahead of today’s equally primitive viruses, which usurp machine facilities
and are designed to try to copy themselves onto other systems. But scientists
at IBM are working on new software that would resemble a biological immune
system to help networks react more quickly to viral assaults of the future.

The system will not only identify the virus and repair files that have
been modified, but also send a message to every other computer on the network
to tell them how to destroy the virus.

Computer viruses are often introduced onto single computers or networks
accidentally from floppy discs. The danger that viruses represent to corporate
data means some companies have made inserting a floppy disc of unknown origin
into a computer a sackable offence. However, Steve White, manager of IBM’s
High Integrity Computing Lab (HICL) in New York, says: ‘We don’t want users
worrying about infecting their computers.

Today, says White, viruses travel very slowly; even the successful ones
take months or even years to become prevalent. Current antivirus products
– such as IBM’s AntiVirus 6.1 – are updated to deal with newly recognised
viruses each month or quarter, which is sufficient to deal with this relatively
slow spread. But White warns that in future, millions of users will plug
in to networks and any virus present will spread extremely quickly, infecting
hundreds or thousands of computers in a matter of minutes or hours.

At present, whenever a new virus is recognised it is quickly distributed
among an informal network of virus collectors – such as those at the HICL
– many of whom work for software companies selling antivirus software. They
dissect the new program to discover how it works, identify its ‘signature’
– the telltale pattern of bytes it inserts in any file that it modifies
in the infected computer – and add that to antiviral programs’ ‘wanted lists’.
White says current programs recognise about 2000 viruses.

But this is too slow a process for the world that White envisages. So
the HICL is creating a system that will identify viruses, not by comparing
their code to a reference library, but by watching them at work.

A typical virus seeks out data files that are frequently accessed or
modified because it can use them to infect programs that come into contact
with lots of files. The algorithms being developed at IBM also watch such
files for any sign of tampering, and then begin to create ‘decoy files’
which are repeatedly accessed (but not altered) to make them attractive
to a virus. If a decoy file grows longer, the system has both caught the
virus at work and its signature.

The automatic program would then scan the computer for files the virus
had modified, repair them and add the new viral signature to its database.
A message to every other computer on the network would tell them to search
and destroy this virus.