The Mathematical Foundations of Viral Propagation: A Forensic Analysis of Gleissner’s 1989 Theory

I still remember the first time I read a paper from the late 1980s that tried to explain computer viruses with actual mathematics instead of scare stories. Most of the coverage from that era was tabloid-style panic — “electronic plagues” wiping out floppy disks — but tucked away in the academic literature was a quieter, more rigorous effort to model how a virus actually spreads through a population of programs and machines. William Gleissner’s 1989 paper, “A Mathematical Theory of the Spread of Computer Viruses,” is one of those foundational pieces of work that almost nobody outside academic security circles has read, yet its fingerprints are all over how I think about propagation dynamics today.

This is my forensic retrospective on that theory: what it claimed, the math underneath it, why it mattered, and how well it holds up against the malware landscape I work in now, decades later.

Why 1989 Was the Right Moment for This Question

By 1989, the world already had Fred Cohen’s formal definition of a computer virus (1984) and the Morris Worm had just torn through the early internet in November 1988. Security researchers were no longer asking “can a virus exist?” — Cohen had already proven that mathematically using recursive function theory. The new question was: how fast, and under what conditions, does a virus spread?

Gleissner approached this the way a mathematician trained in dynamical systems would: build a discrete-time model of infection, define the variables that matter, and derive equations that predict growth. This was a deliberate departure from the purely computability-theoretic angle Cohen had taken. Where Cohen asked “is detection decidable?”, Gleissner asked “given a sharing pattern between machines, what does the infection curve look like?”

The Core Model

At its heart, Gleissner’s model treats a population of programs (or disks, in the floppy-disk-sharing culture of the era) as a set of discrete units that can be in one of two states: infected or clean. The model advances in discrete time steps, and at each step, some number of clean programs come into contact with infected ones through normal sharing behavior — copying a disk, running a shared utility, exchanging software at a user group meeting.

A simplified version of the recurrence relation looks like this:

I(t+1) = I(t) + c * I(t) * (N - I(t)) / N

Where:

If that structure looks familiar, it’s because it is mathematically a close cousin of the logistic growth equation used in epidemiology and population biology. Gleissner was explicit about this connection — he was one of the earlier writers to formally borrow the SIR (Susceptible-Infected-Recovered) epidemiological framework and adapt it to software populations, years before “computer epidemiology” became a common phrase in security research.

Breaking Down the Assumptions

What made Gleissner’s paper valuable wasn’t just the equation — plenty of people can write down a logistic curve. It was that he was careful about stating the assumptions the model depended on, and where those assumptions would break in the real world:

1. Homogeneous mixing — every clean program has an equal chance of contacting any infected program. This is a reasonable simplification for a bulletin board or a shared floppy pool, but it falls apart the moment you have network topology, organizational boundaries, or air-gapped systems.
2. Constant contact rate — the coefficient c doesn’t change over time. In reality, user behavior changes as awareness of an outbreak spreads (people stop sharing disks, IT departments issue advisories), so c is really a function of time, not a constant.
3. No removal/cure state — the earliest version of the model doesn’t account for disinfection. Later refinements (and this is where the model starts resembling a full SIR system) add a “cured” or “immune” compartment, since antivirus signatures and user awareness eventually pull infected units out of circulation.
4. Closed population — N is fixed. New program installations, new machines joining a network, and software updates all violate this in practice.

Visualizing the Propagation Model

flowchart TD
    A[Clean Program / Disk] -->|Contact with infected unit, rate c| B{Infection Successful?}
    B -->|Yes| C[Infected Program]
    B -->|No| A
    C -->|User notices symptoms or AV scan| D[Detected / Disinfected]
    C -->|Continued sharing, rate c| A
    D -->|Removed from susceptible pool| E[Immune / Patched]
    E -.->|Reinfection possible if signature outdated| A

This diagram captures the essential state transitions that Gleissner’s equations describe numerically: susceptible programs becoming infected, infected programs occasionally being caught and cleaned, and the population dynamics that follow from those transition rates.

How the Math Plays Out: A Worked Example

Suppose an organization in 1989 has 500 floppy disks in circulation (N = 500), starts with a single infected disk (I(0) = 1), and has a contact coefficient of c = 0.3 per week — a fairly active sharing culture for a mid-sized office.

This is the classic S-curve: slow early growth, an explosive middle phase, and saturation as the infected population approaches N. What strikes me looking at this table now is how closely it mirrors the shape of ransomware outbreak curves I’ve analyzed in incident response — WannaCry’s spread in 2017 followed almost exactly this logistic shape before the kill-switch domain was registered and growth flattened.

Forensic Comparison: Theory vs. What Actually Happened

Gleissner’s paper was theoretical — it wasn’t built by reverse-engineering a specific real outbreak. But when I map it against documented incidents from the disk-sharing era and later, the model’s core insight holds up remarkably well even if the specific assumptions don’t:

• Brain virus (1986): Spread through pirated software and floppy disk sharing among university populations — a textbook homogeneous-mixing environment that matches Gleissner’s assumptions closely.
• Jerusalem virus (1987): Spread through corporate networks with more structured sharing patterns — contact wasn’t uniform, which is exactly the kind of deviation Gleissner flagged as a model limitation.
• Morris Worm (1988): Exploited network protocols directly rather than human sharing behavior, so the “contact rate” became a function of network scanning speed rather than human behavior — a fundamentally different mechanism that the pure logistic model doesn’t capture well without modification.

Where the Model Falls Short (And Why That’s Still Useful)

I want to be honest about the limitations here, because a forensic retrospective that only praises its subject isn’t doing its job.

• No network topology. Real infection spreads over graphs — social networks, corporate LANs, the internet’s autonomous system structure — not over a uniformly mixed pool. Later work (much of it building on epidemiological graph theory in the 2000s and 2010s) replaced the homogeneous mixing assumption with actual network models, producing far more accurate predictions for internet-scale worms.
• No adversarial adaptation. The model assumes the virus’s behavior is static. Modern malware is polymorphic, metamorphic, and often has command-and-control channels that let an attacker change behavior mid-outbreak — something no 1989 model anticipated because that capability barely existed yet.
• No defender feedback loop with realistic delay. Detection and patching in the real world lag behind infection by days to months (see the average “time to patch” statistics NIST and various vendor telemetry reports publish annually), and that lag is itself a function of severity, visibility, and vendor response time — not a fixed rate.

Despite all that, the fundamental contribution stands: viral spread is quantifiable, predictable within bounds, and follows growth patterns borrowed from biology. That single idea reshaped how security teams think about outbreak response — moving from “patch when you notice” to “model the curve and get ahead of the inflection point.”

Practical Relevance for Today’s Security Teams

Even though nobody is running Gleissner’s exact equations in a SOC dashboard, the conceptual descendants of this model are everywhere:

• Vulnerability exploitation forecasting — teams like those behind the Exploit Prediction Scoring System (EPSS) use statistical models descended from this same lineage to estimate the probability a CVE will be exploited in the wild.
• Worm containment planning — incident responders still reason in terms of R0-like values (a basic reproduction number) when deciding whether a contained outbreak will die out on its own or needs active intervention.
• Botnet growth modeling — researchers tracking botnets like Mirai used logistic and SIR-family models to estimate device recruitment rates almost identical in structure to Gleissner’s 1989 equations.

Common Mistakes When Applying Epidemiological Models to Malware

1. Treating c as constant over the life of an outbreak — it isn’t; defensive response changes it.
2. Ignoring network structure and assuming uniform mixing for internet-scale threats.
3. Forgetting the “susceptible” pool shrinks not just from infection but from patching, which needs its own term in the model.
4. Applying continuous-time differential equation solutions to what is fundamentally a discrete-event process, producing subtly wrong short-term predictions.

FAQs

Was Gleissner’s paper the first to apply mathematical modeling to computer viruses? No — Fred Cohen’s earlier work (1984) established the formal, computability-theoretic definition of a virus. Gleissner’s contribution was specifically the propagation dynamics angle, borrowing from epidemiology rather than computability theory.

Does this model apply to modern ransomware? The underlying logistic growth shape still describes many self-propagating ransomware worms reasonably well (WannaCry, NotPetya), though modern variants that rely on targeted phishing rather than self-propagation don’t fit a pure epidemiological model.

Is this related to the SIR model used in public health? Yes, directly. Gleissner’s framework is structurally a discrete-time analogue of the Susceptible-Infected-Recovered model long used in epidemiology, adapted to a population of software units instead of people.

Why does the growth curve slow down near the end? Because the pool of remaining susceptible (uninfected) units shrinks — there are fewer new targets left to infect, which is the same saturation effect seen in any logistic growth process.

Summary and Recommendations

Gleissner’s 1989 theory deserves more recognition than it gets. It was one of the earliest rigorous attempts to answer a question that is still central to incident response today: not just “can this spread?” but “how fast, and when should I expect it to peak?” The specific equations are dated, but the intellectual move — treating malware propagation as a quantifiable dynamical system rather than a mysterious digital plague — is foundational to everything from EPSS scoring to modern botnet research.

If you want to go deeper, I’d recommend these directions:

• Fred Cohen, “Computer Viruses: Theory and Experiments” (1984) — the formal predecessor to this line of research.
• MITRE ATT&CK framework (https://attack.mitre.org) — for how modern propagation techniques are catalogued.
• NIST SP 800-61 Rev. 2, “Computer Security Incident Handling Guide” — for how outbreak response is structured today.
• CISA’s advisories on self-propagating malware (https://www.cisa.gov) — for contemporary case studies that still show logistic-shaped growth curves.

This is a sensitive area of security history to write about responsibly, and I’ve kept this piece to theory, historical analysis, and defensive framing rather than operational detail.