# Would it ever be possible for computer viruses to evolve new “genes” to allow them to perform their job?

As an A-level Biology student, I have thought a lot about the links with Biology and Computer Science, and something that often comes to mind are the links between Immunology and Computer Security/Viruses. For example, I (through reading about how the anti-virus programs work) decided that the way the immune system handles viruses is very similar to anti-virus programs (both contain a database of virus definitions (be it, $\beta$ memory cells or virus signatures) and both contain a method of extrapolation). The natural progression for me was then thinking about natural evolution of viruses compared to computer viruses. So on to my question:

Would it ever be possible for computer viruses to evolve into new strains which possess new "genes" to allow them to perform their job?

It seems like this sort of thinking could only really apply to viruses, I mean your regular old calculator is never going to be subject to "natural selection". But as far as I know viruses do mutate themselves, in order to avoid anti-virus programs, but presumably these are rather controlled, so that the virus wouldn't gain non-beneficial mutations that might otherwise render it useless. If the true random nature of nature could be applied to viruses, would they ever be able to evolve new functionality, like for example becoming a retro-virus that takes over an anti-virus program, or mutating to include new code that allows it to bring down a firewall? Would they be involved in some sort of computational natural selection, where the strongest viruses survive and pass on their beneficial genes?

• A really cool question! I do think, though, that the "virus" metaphor for malware is fairly insufficient. My understanding was that the main (only?) think computer viruses and real viruses have in common is their ability to spread themselves. – jmite Jun 26 '14 at 16:52
• @jmite well, for me at least, the similarities lie in the fact they yes, they do replicate, they also take control of the system they are attacking in some/most cases, they mostly cause harm to the victim (except a few benevolent computer viruses). They also both have similar methods to be removed (ie immune system and anti-virus programs) and also the second time a computer meets the same virus it removes it faster (as a virus definition is now available) similar to the immune system. This similarity is probably why they were named viruses in the first place :D – J_mie6 Jun 26 '14 at 17:20
• The problem is, several of those are false. The second time a computer meets a virus, it doesn't remove it any faster. Computers can't come up with virus definitions on their own. They come from security companies, and will likely come from a mix of data mining and human crafting. A virus isn't an outside force, the way it is in a body. The computer doesn't see a difference between the virus and any other program. It's just a chunk of code. That's why it runs it. The only difference is that the effect of that program is something that we as users don't want. – jmite Jun 26 '14 at 17:26

I suppose it would be possible in theory, but computer malware (viruses, worms, etc.) typically don't work this way today, and there are good reasons why they're written the way they are.

You might be interested in polymorphic code, which changes itself to evade detection. It changes the sequence of instructions to some other sequence of instructions that will have the same effect, but will have a different binary. This helps evade detection by anti-virus tools that are looking for a specific "signature" of bytes. However, this is not the form of mutation you are asking about, because it will never cause the malware to "evolve" some new behavior it didn't already have.

Really, there is not much reason why malware authors would want or need their malware to evolve new functionality. They can either build the desired behavior into the malware. Or, they can have the malware contact a central "command & control" server to download new code ("software updates" for the malware) periodically, to let them control the behavior of the malware. Usually the bad guys work out offline what attacks they want to mount, and then implement this in the malware or command the malware to perform those attacks.

By working out the attacks offline, in advance, the attackers can test those attacks on their own systems and make sure they'll work properly and won't be detected. From the attacker's perspective, this is a lot better than writing malware that randomly tries stuff in hopes it'll evolve to a useful attack; malware that tries random stuff will be a lot more likely to set off alarms and be detected.

So, there's not really any need or motivation for using "natural selection" in malware, and it's not typically seen in practice.

• Yes, polymorphic code was what I was after as a tag, but it didn't exist! Your answer raises some nice points, and I would +1 if I could (consider it done when I have the rep here), I didn't know that viruses can download updates, how do they achieve this? Is it via the infected machines connections? – J_mie6 Jun 25 '14 at 21:41
• @J_mie6, they make a network connection to a central server (controlled by the attacker) and ask it: "do you have any new software for me?" and if the answer is yes, they download it and execute what they just downloaded. Alternatively, they might ask the central server: "do you have any commands for me?" and if the central server says yes, they do whatever the central server commands them to do. Do a little reading on botnets and C&C servers to learn more about this subject. [If my answer is the most useful after a day or two, you can check the tickmark to accept it.] – D.W. Jun 25 '14 at 21:49
• there are many reasons that malware would benefit from (general) adaptive strategies. for example some attack algorithms can be optimized based on adaptive strategies. malware has indeed been "evolving" over many years, but not autonomously, instead via author improvements. – vzn Jun 26 '14 at 15:08

TL;DR: computers are not autonomous entities like organisms, with any survival instinct. They just run instructions, and sometimes they run instructions we don't like, so we run other instructions to find the bad ones.

I started to say this in the comments, but I think there's a lot more to be said.

The virus metaphor is outdated and too widely used by people who don't understand how computers actually work. They try to liken them to living things, because they understand living things. Here's a better metaphor.

You are an office worker. You work for a giant mega-corporation, where you don't see your boss. You aren't ever told why you do your job, you don't even know what your company does. All you know is that you show up to work every day, and you follow your instructions.

There's a little window by your desk, which is the only way you ever interact with anyone else. You don't see anyone, but sometimes pieces of paper come through the window.

Your instructions are always the same at the start, but you have a huge pile papers at your desk. Some of these contain instructions, some of them contain things you've written. Sometimes your instructions will tell you to find a different piece of paper, and start using it as your instructions. Sometimes they tell you to change the pieces of paper, ripping them up, or erasing parts of them. (This is what running a program is. Sometimes programs edit files, sometimes they run other programs, etc.)

Sometimes your instructions tell you to wait by the window for more paper to come. The paper might have a picture on it, it might have text, or it might have more instructions. (This is what happens when a computer waits for mouse input or keyboard input, or something from a network (i.e. files)).

You do nothing but follow these instructions. You never know why, you never know for whom, but you just do it.

Sometimes, your instructions tell you to multitask. You have a pile of papers. You set a timer, and you work on the instructions from the top paper for 5 minutes. When the timer goes, you put that paper on the bottom of the pile, and do whatever is on the new top paper. (This is how computers run more than one program at once).

Now one day you're waiting for a piece of paper by the window, and you know when you get it, you're going to do whatever it says, because that's what the last piece of instructions told you to do. You get it, and it says to find some of your main pieces of paper, with your core instructions, and erase them. It tells you new instructions to put there. These are doing some strange things, like sending your files out the window to strange places, or collecting backup copies of all the things that come through the window. But what's important is, you don't think anything of it. They are just more instructions. You just do them.

This is what a virus is. It's just a set of instructions that you trick the computer into running.

Now, say you're a multitasking worker. You get one of these erasing instructions in the window. But, you're busy, so you put it onto the bottom of the pile. You look at the top of your pile of stuff to do, and there's a set of instructions marked "antivirus". It says to read through all your papers, and see if any of them look like their sample paper. You do, and you see that the erasing instructions is on your list.

Note that if you start running the virus instructions, you don't think anything of it. Without an antivirus, there is no attack, there is no immune response. It's not attacking you, it's just a set of instructions. The antivirus is just a TODO list that involves looking at your other instructions and finding ones that match a pattern. It's not trying to preserve the system as a whole, it's just a sheet of paper that someone gave you from the window, because it prevents other people from tricking you into doing stuff by putting stuff through the window.

Now, what about your "evolving" viruses? This is certainly possible, but let's look at what this entails. An evolving virus is basically a sheet of instructions that tells you how to make more instructions. It's a piece of paper that tells you to erase a bunch of your old instructions, and then put new ones in its place, but those new instructions also tell you to erase old instructions, and put new ones, and so on. So the original instructions aren't changing. The virus isn't mutating. Instead, it's just doing whatever it does, while also leaving behind instructions to create its next generation.

So, is it possible to do this? Yes. But it's extremely complicated. To have a program that changes itself, but having that sequence of changing not eventually converge to a program that does nothing useful, is incredibly complex.

• Well, really, although I agree with what you are saying, where you say that to a computer a virus is just regular instructions, the same applies to the body, to a regular cell, the virus is just a set of extra instructions, and all cells do is make proteins, in this case the viruses proteins, it is the white blood cells job to detect the viruses as it is the anti-viruses job to request the detection of the viruses. That's how viruses replicate, they have a dependency on the fact that the body will just follow instructions! – J_mie6 Jun 26 '14 at 18:14
• And, I do agree with what you are saying about making the viruses have meaningful mutations, but if you think about real viruses, they are just a set of instructions, like a program. When they mutate, they are either detrimental or beneficial, yet in the end the virus evolves into something new. That is what I am thinking, it doesn't matter if the mutation is good or bad, just that it happens every so often. And also, I like your analogy :) – J_mie6 Jun 26 '14 at 18:16
• I guess, but the problem is, the body has its own functions. The analogy would only really hold if the body was something that did nothing but process chunks of DNA from the outside world all day, and a virus was one that took advantage of that. The idea is that there isn't the same idea of a "foreign" body, that to a computer a program is just a program. – jmite Jun 26 '14 at 18:18

the general question is about evolution in malware. the specific question is about genes. there is indeed a genetic algorithm mechanism that uses digital "genes" for optimization & could certainly conceivably be used in viruses/malware, although there do not seem to be any reports of this so far "in the wild". on the other hand, malware has indeed been evolving over many years from more of a theoretical curiosity to one involving organized cybercrime etcetera, with increasing sophistication in the threats. so far this is fueled largely (but not entirely!) by human-developer-driven "evolution". computer viruses can in some sense be said to be generally evolving increased "intelligence" or "attack sophistication" over time.

here are some references that study the "evolution of/in malware".

• Stuxnet has gone rogue and infected the ISS. – noɥʇʎԀʎzɐɹƆ Aug 16 '16 at 16:49

The main thing is getting it up and running. Naive versions, i.e. Taking an existing somewhat-successful piece of malware, and making every reproduction attempt have mutations, would likely be lethal to the malware in most cases.

This does not, however, mean, that it could not evolve, just that its original purpose, replication, might be hindered. With a low enough mutation rate and enough patience, beneficial and benign mutations would eventually be selected for.

One problem, however, is that they WOULD evolve. Specifically, they would evolve on pure Darwinian principles. If I write a piece of code that executes, and then, only on successful execution, copies its binary file 1000 times to 1000 locations with a random error or several in each and executes them all, it might seem like I have made replication contingent upon completing whatever task is being done successfully, but in reality, replication is only contingent upon the program THINKING it has completed that task successfully.

So there is a fair chance that if this were a piece of malware, its two basic aims, specifically, replication and screwing up people's computers, would be at odds with each other. Over a sufficiently long time, a mutation would probably arise to either make it not screw up their computers as badly, making it less important for anti-virus to deal with, thus, replicating with minimal symptoms, as is the most effective early strategy in pandemic or plague inc, or make it lie to itself that it even succeeded in screwing up their computers at all, turning the primary function into an intron fairly quickly upon it failing to execute but the replication function continuing to work.

Many people marvel at the effectiveness of the immune system in defeating all manner of threats, but in a lot of ways, computers are much, much more secure than cells. Your computer can actually just not download a virus in the first place. A perfect anti-virus system with a perfect user doesn't need to scan the hard-drive ever. Computer code cannot just be inserted physically into the hard-drive.

Contrast cells, where viruses have evolved some rather unique PHYSICAL mechanisms of slipping past cell's defenses. For example, some viruses are totally inert until they encounter a cell, but then their physical structure grabs onto and violently punctures the cell membrane to inject their genetic material. This is like a computer virus that physically cuts open your machine and adds new hardware while your OS and antivirus think "this is fine," and execute code found on that hardware.

So it is actually fairly likely that the more benign the code, the better reproduction it can do. In some cases, it might be easier for evolution to convince the user to help it than to evolve new anti-virus. I.E. appending itself to files that are likely to be shared with other users.

So ultimately, it seems more likely to me that the chance of replication is higher when it is useless as a piece of malware as such, and probably higher still if it can convince the user or anti-virus code that it is in fact something benign, important, or beneficial.

Another thing is that most machines have invalid operations, so random edits to code are likely not only to prevent functionality, but also simply cause the code to crash, even with unprotected memory.

Imagine non-malicious computer programs as the microbes in your gut. Imagine a computer virus as a infectious bacteria.

The computer can't tell the difference between the good bacteria and the bad bacteria, unlike the immune system.

It would be simple to make a self-modifying program, but 99% of mutations would result in an error. A program is like a list of instructions - and computers are very strict about how those instructions are written. Say we have this program:

1. Add one tablespoon of peanut butter.

A mutation might result in this program:

1. Add one tablespoon of peahut butter.