White Paper: Computer viruses as artificial life

Viruses were originally seen as benevolent. Now they can wreak havoc and scientists are asking whether they are a form of...

Viruses were originally seen as benevolent. Now they can wreak havoc and scientists are asking whether they are a form of artificial life. We look at the arguments

This paper begins with a description of how computer viruses operate and their history, and of the various ways computer viruses are structured. It then examines how viruses meet properties associated with life as defined by some researchers in the area of artificial life and self-organising systems. The paper concludes with some comments directed towards the definition of artificially "alive" systems and experimentation.

There has been considerable interest in computer viruses during the last several years. One aspect of this interest has been to ask if computer viruses are a form of artificial life, and what that might imply. To address this, we must first understand something of the history and structure of computer viruses. Thus, we will begin with a condensed, high-level description of computer viruses, their history, structure and how they relate to some properties that might define artificial life.

Viruses as artificial life

The first, and obvious, question is "How do we define life?" Without an answer to this question, we will be unable to say if a computer virus is "alive". One very reasonable list of properties associated with life included:

Life is a pattern in space-time rather than a specific material object

Self-reproduction, in itself or in a related organism

Information storage of a self-representation

A metabolism that converts matter/energy

Functional interactions with the environment

Interdependence of parts

Stability under perturbations of the environment

The ability to evolve

Growth or expansion

Let us examine each of these characteristics in relation to computer viruses.

Viruses as patterns in space-time

There is a near match to this characteristic. Viruses are represented by patterns of computer instructions that exist over time on many computer systems. Viruses are not associated with the physical hardware, but with the instructions executed (sometimes) by that hardware. Computer viruses, like all functional computer code, are simply manifestations of algorithms. The algorithms themselves also represent an underlying pattern. It is questionable if these patterns exist in space, however, unless one extends the definition of space to "cyberspace", as represented by a computer system. The patterns of the viruses are a temporary set of electrical and magnetic field changes in the memory or storage of computer systems. The existence of the virus is only within these patterns of energy. Arguably, the code for each virus could be printed in ink on paper, resulting in a more substantiative existence. That, however, is merely a representation of the true virus and should not be viewed as existence any more than a picture of a person is itself the person.

Self-reproduction of viruses

One of the primary characteristics of computer viruses is their ability to reproduce themselves (or an altered version of themselves). Thus, this characteristic seems to be met. However, it is perhaps more interesting to examine this aspect in light of the agent of reproduction. The virus code is not itself the agent - the computer is. It is questionable if this can be considered sufficient for purposes of classification as artificial life. To do so would imply that the blueprints for a Xerox machine are capable of self-reproduction: when outside agents follow the instructions therein, it is possible to produce a new machine that can then be used to make a copy of them. It is not the blueprint (algorithm; virus) that is the agent of change, but the entity that interprets it.

Information storage of a self-representation

This is the most obvious match for computer viruses. The code that defines the virus is a template that is used by the virus to replicate itself. This is similar to the DNA molecules of what we recognise as organic life.

Virus metabolism

This property involves the organism taking in energy or matter from the environment and using it for its own activity. Computer viruses use the energy of computation expended by the system to execute. They do not convert matter, but make use of the electrical energy present in the computer to traverse their patterns of instructions and infect other programs. In this sense, they have a metabolism.

Again, however, we are forced to change this view if we examine the case more closely. The expenditure of energy is not by the virus, but by the underlying computer system. If the virus were not active, and an interactive game were being run instead, the same amount of energy would be used. In most systems, even if no program is being run, the energy use remains constant. Thus, we must conclude that viruses do not actually have a metabolism.

Functional interactions with the virus' environment

Viruses perform examinations of their host environments as part of their activities. They alter interrupts, examine memory and disk architectures, and alter addresses to hide themselves and spread to other hosts. They very obviously alter their environment to support their existence. Many viruses accidentally alter their environment because of bugs or unforeseen interactions. The major portion of damage from all computer viruses is a result of these interactions.

Interdependence of virus parts

Living organisms cannot be arbitrarily divided without destroying them. The same is true of computer viruses. Should a computer virus have a portion of its "anatomy" excised, the virus would probably cease to function normally, if at all. Few viruses are written with superfluous code, and even so, the working code cannot be divided without disabling the virus.

However, it is interesting to note that the virus can be reassembled later and regain its functional status. If a living organism (as we know them) were to be divided into its component parts for a period of time, then reassembled, it would not become "alive" again. In this sense, computer viruses are more like simple machines or chemical reactions rather than instances of living things.

Virus stability under perturbations

Computer viruses run on a variety of machines under different operating systems. Many of them are able to compromise (and defeat) anti-virus and copy protection mechanisms. They may adjust on-the-fly to conditions of insufficient storage, disk errors, and other exceptional events. Some are capable of running on most variants of popular personal computers under almost any software configuration - a stability and robustness seen in few commercial applications.

Virus evolution

Here, too, viruses display a difference from systems we traditionally view as "alive". No computer viruses evolve as we commonly use the term, although it is conceivable that a very complex virus could be programmed to evolve and change. However, such a virus would be so large and complex as to be many orders of magnitude larger than most host programs, and probably bigger than the host operating systems. Thus, there is some doubt that such a virus could run on enough hosts to allow it to evolve. (Note that "evolve" implies a change in function or attributes; polymorphic viruses represent cases of random changes in structure but not functionality.)

Higher-level mutations of viruses do exist, however. There are variants of many known viruses, with over a dozen known for some IBM PC viruses. The variations involved can be very small, on the order of two or three instructions difference, to major changes involving differences in messages, activation and replication. The source of these variations appears to be programmers (the original virus authors or otherwise) who alter the viruses to avoid anti-viral mechanisms, or to cause different kinds of damage. Polymorphic viruses alter their copies to avoid detection, but the pattern of alteration is ultimately a human product. These changes do not constitute evolution, however.

Interestingly, there is also one case where two different strains of a Macintosh virus are known to interact to form infections unlike the "parents", although these interactions usually produce "sterile" offspring that are unable to reproduce further. This likewise does not appear to be evolution as we know it.


Viruses certainly do exhibit a form of growth, in the sense that there are more of them in a given environment over time. Some transient viruses will infect every file on a system after only a few activations. The spread of viruses through commercial software and public bulletin boards is another indication of their wide-spread replication. Although accurate numbers are difficult to derive, reports over the last few years indicate an approximate yearly doubling in the number of systems infected by computer viruses. Clearly, computer viruses are exhibiting significant growth.

Other behaviour

As already noted, computers viruses exhibit "species" with well-defined ecological niches based on host machine type, and variations within these species. These species are adapted to specific environments and will not survive if moved to a different environment.

Some viruses also exhibit predatory behaviour. For instance, the DenZuk virus will seek out and overwrite instances of the Brain virus if both are present on the same system. Other viruses exhibit territorial behaviour - marking their infected domain so that others of the same type will not enter and compete with the original infection. Some viruses also exhibit self-protective behaviour, including camouflage techniques.

It is important to note, however, that none of these characteristics came from the viruses themselves. Rather, each change and addition to virus behaviour has been wrought by an outside agency: the programmer. These changes have been in reaction to a perceived need to "enhance" the virus - usually to make it more difficult to find.

It might well be argued that more traditional living organisms may also undergo change from without. As an example, background radiation may cause occasional random mutations. However, programmers are the only source of change to computer viruses, and this distinction is worth noting; other living systems undergo changes to themselves and their progeny without obvious outside agencies.

Concluding comments

Our study of computer viruses at first suggests they are close to what we might define as "artificial life". However, upon closer examination, a number of significant deficiencies can be found. These lead us to conclude that computer viruses are not "alive", nor is it possible to refine them so as to make them "alive" without drastically altering our definition of "life".

Nonetheless, we can observe that computer viruses (and their kin) provide an interesting means of modelling life. For at least this reason, research into computer viruses (using the term in a broader sense, to include patterns that are beneficial) may be of some scientific interest. By modelling behaviour using computer viruses, we may be able to gain some insight into systems with more complex interactions. Research into competition among computer viruses and other software, including anti-viral techniques, is of practical interest as well as scientific interest. Modified versions of viruses such as Thimbleby's Liveware may also prove to be of ultimate value. Research into issues on virus defense methods, epidemeology, and on mutations and combinations also could provide valuable insight into computing. But self-reproducing code is easier to write than to control, and encouraging its production in uncontrolled environments is irresponsible; accidents happen all too frequently with computers.

There is something of great importance already to be learned from the study of computer viruses: the critical realisation that experimentation with systems in some ways (almost) can be hazardous. Computer viruses have caused millions of dollars of damage and untold aggravation. Some of them have been written as harmless experiments that "got away" and others as malicious mischief. A great many of them have firmly rooted themselves in the pool of available computers and storage media, and they are likely to be frustrating users and harming systems for years to come. Similar, but considerably more tragic results could occur from careless experimentation with organic forms of artificial life. We must never lose sight of the fact that "real life" is of much more importance than "artificial life" and we should not allow our experiments to threaten our experimenters.

( Eugene H. Spafford, Department of Computer Sciences, Purdue University

Will Garside

This was first published in January 1999



Enjoy the benefits of CW+ membership, learn more and join.

Read more on Hackers and cybercrime prevention



Forgot Password?

No problem! Submit your e-mail address below. We'll send you an email containing your password.

Your password has been sent to:




  • Dissecting the Hack

    In this excerpt from chapter three of Dissecting the Hack: The V3RB0TEN Network, authors Jayson E. Street, Kristin Sims and Brian...

  • Digital Identity Management

    In this excerpt of Digital Identity Management, authors Maryline Laurent and Samia Bousefrane discuss principles of biometrics ...

  • Becoming a Global Chief Security Executive Officer

    In this excerpt of Becoming a Global Chief Security Executive Officer: A How to Guide for Next Generation Security Leaders, ...