Advanced topic: total computers infected every month

http://www.kumite.com/myths

Your CIO can reduce virus hoaxes in your firm. Here's how

MYTH: "viruses infect up to 25% of all IBM PCs every month" (advanced discussion)

Rob Rosenberger says:

Statisticians occasionally chastize Ross Greenberg and me for using a "summation" formula to dispel this myth. In a purely statistical sense, you wouldn't talk about the percentage of infected computers every month -- rather, you'd talk about the percentage of uninfected computers. Furthermore, when you take percentages over time, incremental values compound in the same way a bank pays interest on your savings.

How does this affect our figures? Well, in the case of the "25%" myth, we would start by saying 75% do not suffer an infection each month. We want to carry this out for four months, so we raise 0.75 to the fourth power (0.75⁴) and get a value of 0.316. This means roughly 31.6% of computers would not get infected in this given four-month timeframe!

As you'll recall from the summary discussion of the "25%" myth, it claims "100%" would get infected in a four-month period. Quite an error! But the "error" gets relatively small if you carry it out for twelve months, i.e. 0.75¹². Then you come up with a value of 0.0317. This means roughly 3.17% of computers would survive an entire year without infection if you take the "25%" myth at face value.

People who know statistics rightly chastize the use of a simple summation to dispel the myth. But we did have our reasons.

First: this myth gained popularity because Americans largely don't understand statistics. This treatise strives to dispel myths in summary fashion. Ross & I struggle to keep summaries concise -- our readers want to know about virus myths, not statistics.

Second: the myth talks about "25% infected" rather than "75% uninfected." We return to the main problem of giving a statistics lesson to someone who really just wants to know about virus myths.

Third: we can get away with using a summation formula because... well, because Americans largely don't understand statistics! Many years passed since Ross & I first tackled this myth (in an early edition of the original Computer Virus Myths treatise). In all this time, I only heard from a dozen or so people who questioned our use of a summation formula.

And on a final note: Ross & I accepted an invitation in 1989 to lecture before the National Academy of Sciences Computer Working Group. None of the attendees questioned our use of a summation formula! Enough said.

Edward Gieszelmann, adjunct professor of mathematics at Sierra College in California, says:

Given 16 computers for which 25% are infected with a virus every month, in the first month four are infected and twelve are not. In the second month, one of the first four is reinfected and three of the others are infected for the first time. Thus in a two month period, seven computers have been infected at least once; one of those seven was infected twice. If you count the number of infections, there were eight; however, if you count the number of computers that were infected in the two month period, you only have seven, which is less than 50%.

The problem lies in the way the result is described: It's wrong to say that all the computers will be infected in a four-month period, but it's correct to say that the number of infections in a four-month period is the same as the number of computers, but that some computers are infected more than once, and some, not at all.

Actually, in the real world, things would not work out so nicely as described above. With an average infection rate of 25%, there could be fewer or more than four infections per month, and there may or may not be reinfections in any particular month. With a small number of computers, it is difficult to accurately predict what will happen. On the other hand, if there are many computers, say 16,000, then multiplying all the numbers above by 1000 would predict fairly well what would happen in the real world.