In SIS/SIRS model the network components which are infected are assumed to recover and go to susceptible state based immediately or after some time based on immunity of the virus.
While in SIR model, once recovered, the nodes are assumed to have become immune to the same disease and no longer participates in the spread of epidemic.
I was just wondering which model describes the computer virus epidemic more accurately.
Like most questions about modeling, the first phrase that comes to mind is, "It depends."
To be precise, if you are looking to model a specific version of the infection, where once the antivirus updates its definitions, the virus cannot affect the same computer again, then SIR would be the better option.
On the other hand, if you want to model infection due to a virus that is constantly getting updated, then one can treat recovery to S as an antivirus update on the computer, but that just saves you from the current version, and not the future versions. Then you can consider modeling it as SIS.
Hope it helps,
Srini
Sir, I understand that but had some confusion related to the same.
In an adversarial model the adversary will want maximum damage to the network it is attacking and hence it would not like to provide immunity to the system it has attacked before until and unless the system has become completely useless. So moving a node to R-state means that either some patch has been applied or the node has been removed from the network entirely, giving it a shape of SIR model.
And moving a node from I-state to S-state definitely means that the patch has been applied against the epidemic.(correct me if I am wrong)
And if the patch has been applied that means it is ineffective in preventing the epidemic from attacking again and is only removing the previous contagion from the node, giving it a shape of SIS model.
So which of them is more idealistic model in real life scenarios for a computer virus?
Hi Manikant,
The immunity is not being provided by the adversary, but by the computer owner himself (or the network admin). If it helps, imagine the network admin's spreading "patches", while the adversary is spreading the virus (with each having multiple versions). At any point of time, a computer node is "safe" (susceptible) if its patch version is later than the virus version it encounters, else it gets infected. So you'll have a SIS dynamic in that case, with transitions happening in both directions.
Of course, I am assuming R-> recovered (and hence a computer node gaining immunity to the current version of the virus). If the virus is 'fatal', then the node gets removed, and you can only have SIR dynamics.
Srini
- Badges
- Science topic