A Computational Model of Computer Virus Propagation: A 2026 Forensic Retrospective

I’ve spent a good chunk of my career reading old security papers the way some people read old maps — not because the terrain hasn’t changed, but because you can’t understand where the roads are now without knowing where they were laid down first. Kephart and White’s early-1990s computational studies at IBM’s High Integrity Computing Laboratory are one of those foundational maps for anyone trying to understand how computer viruses actually spread through populations of machines, rather than how they spread through a single infected file.

This piece is my retrospective look at that body of computational modeling work — simulation-based, not purely analytical — and how its core findings still hold up (or don’t) against the malware ecosystem I deal with in 2026.

Why Simulation, Not Just Equations

The analytical models from the late 1980s (the Gleissner-style logistic and SIR-derived equations) gave clean, closed-form predictions, but they required simplifying assumptions that didn’t match reality — uniform mixing, constant contact rates, no network topology. Kephart and White’s approach, published through several papers between 1991 and 1993, took a different route: build an actual simulated network of machines with realistic contact patterns (based on empirical data about how often people exchanged floppy disks, email attachments, and shared drives) and run the infection process as a discrete-event simulation thousands of times.

This computational approach let researchers ask questions the closed-form equations couldn’t easily answer:

• What happens when the network isn’t uniformly connected but has clusters (departments, organizations, friend groups)?
• What’s the effect of a “kill threshold” — the point at which enough users notice something is wrong and change behavior?
• How does the presence of even a small percentage of “immune” (patched, aware, or running antivirus) nodes change the outbreak trajectory?

The Architecture of the Model

The computational model typically represented the population as a graph:

At each simulated tick, every infected node had a probability of transmitting to each of its susceptible neighbors, weighted by the edge frequency. This is conceptually simple but computationally rich, because the graph structure itself — not just a single infection coefficient — now drove the outbreak shape.

flowchart LR
    subgraph Cluster_A[Department A - dense internal contact]
        A1((Node)) --- A2((Node))
        A2 --- A3((Node))
        A1 --- A3
    end
    subgraph Cluster_B[Department B - dense internal contact]
        B1((Node)) --- B2((Node))
        B2 --- B3((Node))
    end
    A3 -.->|Sparse cross-department link| B1
    A1((Node)):::infected
    classDef infected fill:#f66,stroke:#900,color:#fff

That single sparse cross-department link in the diagram is the key structural insight from this generation of research: outbreaks jump between clusters slowly, but once they arrive in a new cluster, they spread quickly through the dense internal connections. This is precisely why organizational segmentation (VLANs, network zones, least-privilege access) became a core defensive strategy — it deliberately removes or throttles those cross-cluster edges.

What the Simulations Found

A few results from this era of computational modeling turned out to be durable, foundational insights:

1. Small-world effects accelerate outbreaks disproportionately. Even a network that’s mostly clustered can spread a virus almost as fast as a fully connected network if it has just a few long-range “shortcut” edges — the same small-world phenomenon later formalized by Watts and Strogatz in network science generally.
2. A minority of highly-connected nodes drive most of the spread. Machines that touch many others (file servers, shared workstations, systems administrators’ machines) act as super-spreaders. Removing or hardening even a small number of these nodes had an outsized effect on total outbreak size in simulation.
3. Prevalence tends to plateau below 100%, not because the virus stops trying, but because “dead ends” in the network — isolated or low-connectivity nodes — never get exposed. This explained a real-world observation: certain viruses would linger at low levels in a population indefinitely rather than either dying out or infecting everything.

A Simplified Simulation You Can Run Yourself

For illustration, here’s a minimal pseudocode representation of the kind of Monte Carlo simulation this research relied on. This is a generic epidemiological-style simulation for educational modeling purposes, not a virus itself — it has no payload, no replication into other files, and does nothing outside its own in-memory data structure.

import random
import networkx as nx

def simulate_outbreak(graph, initial_infected, infection_prob, cure_prob, steps):
    state = {node: "S" for node in graph.nodes}
    for node in initial_infected:
        state[node] = "I"

    history = []
    for _ in range(steps):
        new_state = state.copy()
        for node in graph.nodes:
            if state[node] == "I":
                # Chance of being cured/detected this step
                if random.random() < cure_prob:
                    new_state[node] = "R"
                    continue
                # Try to infect susceptible neighbors
                for neighbor in graph.neighbors(node):
                    if state[neighbor] == "S" and random.random() < infection_prob:
                        new_state[neighbor] = "I"
        state = new_state
        history.append(sum(1 for v in state.values() if v == "I"))
    return history

g = nx.watts_strogatz_graph(n=500, k=6, p=0.05)
result = simulate_outbreak(g, initial_infected=[0], infection_prob=0.05, cure_prob=0.02, steps=60)
print(result)

This kind of simulation is standard teaching material in network science and epidemiology courses, and it’s exactly the modeling approach security researchers still use today when they want to forecast how a self-propagating threat might move through an organization’s network topology before deciding on segmentation strategy.

Case Study: Applying This Model Retrospectively to Real Outbreaks

Code Red (2001) offers one of the cleanest real-world matches to this computational modeling approach. It scanned random IP addresses rather than following a social contact graph, which is closer to a fully-connected random graph model than a clustered small-world one — and its growth curve was correspondingly close to pure exponential/logistic growth, matching predictions from the simplest version of these models.

Conficker (2008), by contrast, showed clustering effects much closer to the department-graph model above — spread was faster within organizations that had flat internal networks and slower across the internet at large, exactly matching the “fast within cluster, slow across clusters” prediction from 1990s computational modeling.

Defensive Strategies That Come Directly From This Research

• Network segmentation to eliminate or rate-limit the “shortcut” edges that let outbreaks jump between clusters.
• Identifying and hardening super-spreader nodes — file servers, jump boxes, and admin workstations — since simulations consistently show these nodes disproportionately determine total outbreak size.
• Rate limiting and anomaly detection on connection frequency, since the models are driven by contact frequency (edge weight), not just contact existence.
• Patch prioritization based on network centrality, not just severity score — a vulnerability on a low-connectivity endpoint poses less systemic risk than the same vulnerability on a heavily-connected server, something reflected in more recent frameworks like EPSS combined with asset criticality scoring.

Common Mistakes I Still See Teams Make

1. Assuming flat networks are fine because “we have antivirus” — the models show clustering effects dominate outcomes regardless of endpoint detection quality.
2. Under-investing in segmentation because it doesn’t show up as a line item the way an EDR license does.
3. Treating all nodes as equally important when prioritizing patches, ignoring network centrality entirely.
4. Failing to model cross-cluster edges introduced by cloud services, VPNs, and third-party integrations — these are the modern equivalent of the “sparse shortcut” edges that let 1990s-era simulations predict fast cross-department spread.

FAQs

Is this the same as the SIR model used in epidemiology? It’s related but more sophisticated — it’s a network-based extension of SIR-style compartmental modeling, sometimes called an “SIR model on a graph,” which accounts for actual contact structure rather than assuming uniform mixing.

Do modern security tools actually use these models? Yes, in spirit. Threat modeling for lateral movement, blast-radius estimation for ransomware tabletop exercises, and vulnerability prioritization frameworks all draw on the same graph-based propagation logic.

Why did Code Red spread so much faster than Conficker in its early phase? Code Red used random IP scanning rather than a social or organizational contact graph, so it behaved more like a fully-mixed population — closer to the fastest-spreading case these models predict.

Can this kind of model predict ransomware outbreaks today? It can model the self-propagating component of certain ransomware worms, but modern ransomware operations increasingly rely on human-operated lateral movement and initial access brokers, which requires supplementing the graph model with attacker decision-making, something outside pure epidemiological modeling.

Summary and Recommendations

The shift from closed-form equations to computational, graph-based simulation was one of the most important methodological advances in understanding malware propagation. It explained real-world phenomena — clustering, super-spreaders, plateauing prevalence — that the earlier analytical models couldn’t. Decades later, the defensive playbook it produced (segmentation, super-spreader hardening, centrality-aware patching) is still current best practice.

For further reading:

• Kephart & White, “Directed-Graph Epidemiological Models of Computer Viruses” (IEEE Symposium on Security and Privacy, 1991).
• Watts & Strogatz, “Collective dynamics of ‘small-world’ networks,” Nature (1998).
• MITRE ATT&CK, Lateral Movement tactic (https://attack.mitre.org/tactics/TA0008/).
• NIST SP 800-207, “Zero Trust Architecture” — the modern segmentation-first response to these findings.
• CISA Advisory Library (https://www.cisa.gov/news-events/cybersecurity-advisories) for contemporary propagation case studies.