Skip to Content

Automated Virus Busters

Software
September 1, 2000

The latest computer viruses-which can e-mail themselves to everyone in a host computer’s electronic address book and change their appearance or even rewrite their own code to avoid detection-have created new problems for antivirus companies. But it turns out the most difficult challenge isn’t analyzing the viruses or creating fixes for them-it’s handling the flood of requests for help during an epidemic. When a fast-spreading virus infects many computers in a very short time, the number of virus samples submitted to an antivirus company for analysis increases by as much as three orders of magnitude, as does the number of requests for the antidote. This kind of jump makes most Web sites crash, but crashing during a virus outbreak is, obviously, a disaster for an antivirus company.

Researchers at IBM Research in Yorktown Heights, N.Y., in collaboration with Symantec, makers of the popular software Norton AntiVirus, have engineered ways to weather future outbreaks of even faster-spreading viruses. The first advance is a completely automated virus analysis center that develops antidotes and packages the cure for customers considerably faster than human virus analyzers. In March 1999, it took Symantec’s human virus busters six hours to crank out a cure for the Melissa virus, but IBM’s system can do it in 40 minutes. Norton AntiVirus users will have access to the automated virus analysis center this fall.

All the speed in the world won’t help, however, if a system is overwhelmed. To protect the virus analyzer, the group devised a network of gateways that was surprisingly hard to realize, says IBM antivirus researcher David Chess. “The stuff you would think would be the rocket science wasn’t the hardest part,” Chess says. “We had to do some unprecedented things to make the gateways robust to communication errors and sudden loads.”

Like secretaries opening their boss’s mail, the gateways perform triage on incoming viruses. First the gateway finds out if the incoming sample matches previously analyzed files; if it does, the gateway can immediately send the antidote to whoever submitted the virus. If the file matches one that the virus analysis center is working on, the gateway can acknowledge receipt of the virus and later send the antidote when it becomes available. Several IBM patents on the gateway system are pending.

Keep Reading

Most Popular

individual aging affects covid outcomes concept
individual aging affects covid outcomes concept

Anti-aging drugs are being tested as a way to treat covid

Drugs that rejuvenate our immune systems and make us biologically younger could help protect us from the disease’s worst effects.

close up of baby with a bottle
close up of baby with a bottle

The baby formula shortage has birthed a shady online marketplace

Desperate parents just want to feed their babies. They’re having to contend with misinformation, price gouging, and scams along the way.

"Olive Garden" NFTs concept
"Olive Garden" NFTs concept

I tried to buy an Olive Garden NFT. All I got was heartburn.

Our newest issue spells out what you need to know about the dizzying world of digital money.

Stay connected

Illustration by Rose WongIllustration by Rose Wong

Get the latest updates from
MIT Technology Review

Discover special offers, top stories, upcoming events, and more.

Thank you for submitting your email!

Explore more newsletters

It looks like something went wrong.

We’re having trouble saving your preferences. Try refreshing this page and updating them one more time. If you continue to get this message, reach out to us at customer-service@technologyreview.com with a list of newsletters you’d like to receive.