Modeling Penetration of Viruses at the Gateway S Keiichi Kato Supervised by Prof.Hiroshi Toyoizumi

Purpose To make useful when we work out new defense way from viruses by verifying that virus mails obey exponential distribution.

Target Virus Information Experimental data The day using serve time data SWEN.AAvailable September 20,2003 MIMAIL.RNot Available January 28, 2004 LOVGAT.FNot Available July 3, 2003

The common point of the viruses All viruses retrieve mail addresses from some files, make an individual mailing list and send large number of mail by using the list and own SMTP engine.

The feature of SWEN.A The time when it should be necessary to send a mail is under 1-second. Sending mails every several seconds. Not to send all members of mailing list but some members chosen at random

Time data information The day when each virus reached most abundantly was taken as a sample.

Equation To calculate the probability of optional ranges. β decides unit time. To solve Dis is to know whether the result is near to exponential distribution or not. The desirable Dif answer is more closer 0. X is the interval of every virus mail.

Calculations SWEN.A MIMAIL.R LOVGATE.F

Result of SWEN.A Bar graph: The amount of virus mail. Line graph: The exponential distribution. The number of samples: 373 Probability of the top of bar: 14.8% Probability of the top of bar: 12.2% The bar graph isn’t ideal type falling down as it goes to the right. We couldn’t catch the feature of the bar graph.

Result of MIMAIL.R Bar graph: The amount of virus mail. Line graph: The exponential distribution. The number of samples: 1003 Probability of the top of bar: 32.1% Probability of the top of line: 29.4% The bar graph is ideal type and almost matches with the line. The bar graph almost matches with the line.

Result of LOVGATE.F Bar graph: The amount of virus mail. Line graph: The exponential distribution. The number of samples: 519 Probability of the top of bar: 99.9% Probability of the top of line: 47.0% Anyone in University of Aizu sent all mails. We can capture the feature for sending mails.

Conclusion Depending on the network environment and the number of samples, virus mails obey Poisson process though there is an exception. To need to sort out the sending mails from the receiving to obtain correct results.