Viruses were originally seen as benevolent. Now they can wreak
havoc and scientists are asking whether they are a form of
artificial life. We look at the arguments
This paper begins with a description of how computer viruses
operate and their history, and of the various ways computer viruses
are structured. It then examines how viruses meet properties
associated with life as defined by some researchers in the area of
artificial life and self-organising systems. The paper concludes
with some comments directed towards the definition of artificially
"alive" systems and experimentation.
There has been considerable interest in computer viruses during the
last several years. One aspect of this interest has been to ask if
computer viruses are a form of artificial life, and what that might
imply. To address this, we must first understand something of the
history and structure of computer viruses. Thus, we will begin with
a condensed, high-level description of computer viruses, their
history, structure and how they relate to some properties that
might define artificial life.
Viruses as artificial lifeThe
first, and obvious, question is "How do we define life?" Without an
answer to this question, we will be unable to say if a computer
virus is "alive". One very reasonable list of properties associated
with life included:Life is a pattern in space-time rather than a
specific material objectSelf-reproduction, in itself or in a
related organismInformation storage of a self-representationA
metabolism that converts matter/energyFunctional interactions with
the environmentInterdependence of partsStability under
perturbations of the environmentThe ability to evolveGrowth or
expansionLet us examine each of these characteristics in relation
to computer viruses.
Viruses as patterns in space-timeThere
is a near match to this characteristic. Viruses are represented by
patterns of computer instructions that exist over time on many
computer systems. Viruses are not associated with the physical
hardware, but with the instructions executed (sometimes) by that
hardware. Computer viruses, like all functional computer code, are
simply manifestations of algorithms. The algorithms themselves also
represent an underlying pattern. It is questionable if these
patterns exist in space, however, unless one extends the definition
of space to "cyberspace", as represented by a computer system. The
patterns of the viruses are a temporary set of electrical and
magnetic field changes in the memory or storage of computer
systems. The existence of the virus is only within these patterns
of energy. Arguably, the code for each virus could be printed in
ink on paper, resulting in a more substantiative existence. That,
however, is merely a representation of the true virus and should
not be viewed as existence any more than a picture of a person is
itself the person.
Self-reproduction of virusesOne of the
primary characteristics of computer viruses is their ability to
reproduce themselves (or an altered version of themselves). Thus,
this characteristic seems to be met. However, it is perhaps more
interesting to examine this aspect in light of the agent of
reproduction. The virus code is not itself the agent - the computer
is. It is questionable if this can be considered sufficient for
purposes of classification as artificial life. To do so would imply
that the blueprints for a Xerox machine are capable of
self-reproduction: when outside agents follow the instructions
therein, it is possible to produce a new machine that can then be
used to make a copy of them. It is not the blueprint (algorithm;
virus) that is the agent of change, but the entity that interprets
it.
Information storage of a self-representationThis is the
most obvious match for computer viruses. The code that defines the
virus is a template that is used by the virus to replicate itself.
This is similar to the DNA molecules of what we recognise as
organic life.
Virus metabolismThis property involves the
organism taking in energy or matter from the environment and using
it for its own activity. Computer viruses use the energy of
computation expended by the system to execute. They do not convert
matter, but make use of the electrical energy present in the
computer to traverse their patterns of instructions and infect
other programs. In this sense, they have a metabolism.Again,
however, we are forced to change this view if we examine the case
more closely. The expenditure of energy is not by the virus, but by
the underlying computer system. If the virus were not active, and
an interactive game were being run instead, the same amount of
energy would be used. In most systems, even if no program is being
run, the energy use remains constant. Thus, we must conclude that
viruses do not actually have a metabolism.
Functional
interactions with the virus' environmentViruses perform
examinations of their host environments as part of their
activities. They alter interrupts, examine memory and disk
architectures, and alter addresses to hide themselves and spread to
other hosts. They very obviously alter their environment to support
their existence. Many viruses accidentally alter their environment
because of bugs or unforeseen interactions. The major portion of
damage from all computer viruses is a result of these
interactions.
Interdependence of virus partsLiving organisms
cannot be arbitrarily divided without destroying them. The same is
true of computer viruses. Should a computer virus have a portion of
its "anatomy" excised, the virus would probably cease to function
normally, if at all. Few viruses are written with superfluous code,
and even so, the working code cannot be divided without disabling
the virus. However, it is interesting to note that the virus can be
reassembled later and regain its functional status. If a living
organism (as we know them) were to be divided into its component
parts for a period of time, then reassembled, it would not become
"alive" again. In this sense, computer viruses are more like simple
machines or chemical reactions rather than instances of living
things.
Virus stability under perturbationsComputer viruses
run on a variety of machines under different operating systems.
Many of them are able to compromise (and defeat) anti-virus and
copy protection mechanisms. They may adjust on-the-fly to
conditions of insufficient storage, disk errors, and other
exceptional events. Some are capable of running on most variants of
popular personal computers under almost any software configuration
- a stability and robustness seen in few commercial
applications.
Virus evolutionHere, too, viruses display a
difference from systems we traditionally view as "alive". No
computer viruses evolve as we commonly use the term, although it is
conceivable that a very complex virus could be programmed to evolve
and change. However, such a virus would be so large and complex as
to be many orders of magnitude larger than most host programs, and
probably bigger than the host operating systems. Thus, there is
some doubt that such a virus could run on enough hosts to allow it
to evolve. (Note that "evolve" implies a change in function or
attributes; polymorphic viruses represent cases of random changes
in structure but not functionality.)Higher-level mutations of
viruses do exist, however. There are variants of many known
viruses, with over a dozen known for some IBM PC viruses. The
variations involved can be very small, on the order of two or three
instructions difference, to major changes involving differences in
messages, activation and replication. The source of these
variations appears to be programmers (the original virus authors or
otherwise) who alter the viruses to avoid anti-viral mechanisms, or
to cause different kinds of damage. Polymorphic viruses alter their
copies to avoid detection, but the pattern of alteration is
ultimately a human product. These changes do not constitute
evolution, however.Interestingly, there is also one case where two
different strains of a Macintosh virus are known to interact to
form infections unlike the "parents", although these interactions
usually produce "sterile" offspring that are unable to reproduce
further. This likewise does not appear to be evolution as we know
it.
GrowthViruses certainly do exhibit a form of growth, in
the sense that there are more of them in a given environment over
time. Some transient viruses will infect every file on a system
after only a few activations. The spread of viruses through
commercial software and public bulletin boards is another
indication of their wide-spread replication. Although accurate
numbers are difficult to derive, reports over the last few years
indicate an approximate yearly doubling in the number of systems
infected by computer viruses. Clearly, computer viruses are
exhibiting significant growth.
Other behaviourAs already
noted, computers viruses exhibit "species" with well-defined
ecological niches based on host machine type, and variations within
these species. These species are adapted to specific environments
and will not survive if moved to a different environment.Some
viruses also exhibit predatory behaviour. For instance, the DenZuk
virus will seek out and overwrite instances of the Brain virus if
both are present on the same system. Other viruses exhibit
territorial behaviour - marking their infected domain so that
others of the same type will not enter and compete with the
original infection. Some viruses also exhibit self-protective
behaviour, including camouflage techniques.It is important to note,
however, that none of these characteristics came from the viruses
themselves. Rather, each change and addition to virus behaviour has
been wrought by an outside agency: the programmer. These changes
have been in reaction to a perceived need to "enhance" the virus -
usually to make it more difficult to find.It might well be argued
that more traditional living organisms may also undergo change from
without. As an example, background radiation may cause occasional
random mutations. However, programmers are the only source of
change to computer viruses, and this distinction is worth noting;
other living systems undergo changes to themselves and their
progeny without obvious outside agencies.
Concluding
commentsOur study of computer viruses at first suggests they
are close to what we might define as "artificial life". However,
upon closer examination, a number of significant deficiencies can
be found. These lead us to conclude that computer viruses are not
"alive", nor is it possible to refine them so as to make them
"alive" without drastically altering our definition of
"life".Nonetheless, we can observe that computer viruses (and their
kin) provide an interesting means of modelling life. For at least
this reason, research into computer viruses (using the term in a
broader sense, to include patterns that are beneficial) may be of
some scientific interest. By modelling behaviour using computer
viruses, we may be able to gain some insight into systems with more
complex interactions. Research into competition among computer
viruses and other software, including anti-viral techniques, is of
practical interest as well as scientific interest. Modified
versions of viruses such as Thimbleby's Liveware may also prove to
be of ultimate value. Research into issues on virus defense
methods, epidemeology, and on mutations and combinations also could
provide valuable insight into computing. But self-reproducing code
is easier to write than to control, and encouraging its production
in uncontrolled environments is irresponsible; accidents happen all
too frequently with computers.There is something of great
importance already to be learned from the study of computer
viruses: the critical realisation that experimentation with systems
in some ways (almost) can be hazardous. Computer viruses have
caused millions of dollars of damage and untold aggravation. Some
of them have been written as harmless experiments that "got away"
and others as malicious mischief. A great many of them have firmly
rooted themselves in the pool of available computers and storage
media, and they are likely to be frustrating users and harming
systems for years to come. Similar, but considerably more tragic
results could occur from careless experimentation with organic
forms of artificial life. We must never lose sight of the fact that
"real life" is of much more importance than "artificial life" and
we should not allow our experiments to threaten our experimenters.
( Eugene H. Spafford, Department of Computer Sciences, Purdue
UniversityWill Garside