Would it ever be possible for computer viruses to evolve new "genes" to allow them to perform their job?

Question

As an A-level Biology student, I have thought a lot about the links with Biology and Computer Science, and something that often comes to mind are the links between Immunology and Computer Security/Viruses. For example, I (through reading about how the anti-virus programs work) decided that the way the immune system handles viruses is very similar to anti-virus programs (both contain a database of virus definitions (be it, $\beta$ memory cells or virus signatures) and both contain a method of extrapolation). The natural progression for me was then thinking about natural evolution of viruses compared to computer viruses. So on to my question:

Would it ever be possible for computer viruses to evolve into new strains which possess new "genes" to allow them to perform their job?

It seems like this sort of thinking could only really apply to viruses, I mean your regular old calculator is never going to be subject to "natural selection". But as far as I know viruses do mutate themselves, in order to avoid anti-virus programs, but presumably these are rather controlled, so that the virus wouldn't gain non-beneficial mutations that might otherwise render it useless. If the true random nature of nature could be applied to viruses, would they ever be able to evolve new functionality, like for example becoming a retro-virus that takes over an anti-virus program, or mutating to include new code that allows it to bring down a firewall? Would they be involved in some sort of computational natural selection, where the strongest viruses survive and pass on their beneficial genes?

Answer 1

I suppose it would be possible in theory, but computer malware (viruses, worms, etc.) typically don't work this way today, and there are good reasons why they're written the way they are.

You might be interested in polymorphic code, which changes itself to evade detection. It changes the sequence of instructions to some other sequence of instructions that will have the same effect, but will have a different binary. This helps evade detection by anti-virus tools that are looking for a specific "signature" of bytes. However, this is not the form of mutation you are asking about, because it will never cause the malware to "evolve" some new behavior it didn't already have.

Really, there is not much reason why malware authors would want or need their malware to evolve new functionality. They can either build the desired behavior into the malware. Or, they can have the malware contact a central "command & control" server to download new code ("software updates" for the malware) periodically, to let them control the behavior of the malware. Usually the bad guys work out offline what attacks they want to mount, and then implement this in the malware or command the malware to perform those attacks.

By working out the attacks offline, in advance, the attackers can test those attacks on their own systems and make sure they'll work properly and won't be detected. From the attacker's perspective, this is a lot better than writing malware that randomly tries stuff in hopes it'll evolve to a useful attack; malware that tries random stuff will be a lot more likely to set off alarms and be detected.

So, there's not really any need or motivation for using "natural selection" in malware, and it's not typically seen in practice.

Answer 2

TL;DR: computers are not autonomous entities like organisms, with any survival instinct. They just run instructions, and sometimes they run instructions we don't like, so we run other instructions to find the bad ones.

---

I started to say this in the comments, but I think there's a lot more to be said.

The virus metaphor is outdated and too widely used by people who don't understand how computers actually work. They try to liken them to living things, because they understand living things. Here's a better metaphor.

You are an office worker. You work for a giant mega-corporation, where you don't see your boss. You aren't ever told why you do your job, you don't even know what your company does. All you know is that you show up to work every day, and you follow your instructions.

There's a little window by your desk, which is the only way you ever interact with anyone else. You don't see anyone, but sometimes pieces of paper come through the window.

Your instructions are always the same at the start, but you have a huge pile papers at your desk. Some of these contain instructions, some of them contain things you've written. Sometimes your instructions will tell you to find a different piece of paper, and start using it as your instructions. Sometimes they tell you to change the pieces of paper, ripping them up, or erasing parts of them. (This is what running a program is. Sometimes programs edit files, sometimes they run other programs, etc.)

Sometimes your instructions tell you to wait by the window for more paper to come. The paper might have a picture on it, it might have text, or it might have more instructions. (This is what happens when a computer waits for mouse input or keyboard input, or something from a network (i.e. files)).

You do nothing but follow these instructions. You never know why, you never know for whom, but you just do it.

Sometimes, your instructions tell you to multitask. You have a pile of papers. You set a timer, and you work on the instructions from the top paper for 5 minutes. When the timer goes, you put that paper on the bottom of the pile, and do whatever is on the new top paper. (This is how computers run more than one program at once).

Now one day you're waiting for a piece of paper by the window, and you know when you get it, you're going to do whatever it says, because that's what the last piece of instructions told you to do. You get it, and it says to find some of your main pieces of paper, with your core instructions, and erase them. It tells you new instructions to put there. These are doing some strange things, like sending your files out the window to strange places, or collecting backup copies of all the things that come through the window. But what's important is, you don't think anything of it. They are just more instructions. You just do them.

This is what a virus is. It's just a set of instructions that you trick the computer into running.

Now, say you're a multitasking worker. You get one of these erasing instructions in the window. But, you're busy, so you put it onto the bottom of the pile. You look at the top of your pile of stuff to do, and there's a set of instructions marked "antivirus". It says to read through all your papers, and see if any of them look like their sample paper. You do, and you see that the erasing instructions is on your list.

Note that if you start running the virus instructions, you don't think anything of it. Without an antivirus, there is no attack, there is no immune response. It's not attacking you, it's just a set of instructions. The antivirus is just a TODO list that involves looking at your other instructions and finding ones that match a pattern. It's not trying to preserve the system as a whole, it's just a sheet of paper that someone gave you from the window, because it prevents other people from tricking you into doing stuff by putting stuff through the window.

Now, what about your "evolving" viruses? This is certainly possible, but let's look at what this entails. An evolving virus is basically a sheet of instructions that tells you how to make more instructions. It's a piece of paper that tells you to erase a bunch of your old instructions, and then put new ones in its place, but those new instructions also tell you to erase old instructions, and put new ones, and so on. So the original instructions aren't changing. The virus isn't mutating. Instead, it's just doing whatever it does, while also leaving behind instructions to create its next generation.

So, is it possible to do this? Yes. But it's extremely complicated. To have a program that changes itself, but having that sequence of changing not eventually converge to a program that does nothing useful, is incredibly complex.

Answer 3

the general question is about evolution in malware. the specific question is about genes. there is indeed a genetic algorithm mechanism that uses digital "genes" for optimization & could certainly conceivably be used in viruses/malware, although there do not seem to be any reports of this so far "in the wild". on the other hand, malware has indeed been evolving over many years from more of a theoretical curiosity to one involving organized cybercrime etcetera, with increasing sophistication in the threats. so far this is fueled largely (but not entirely!) by human-developer-driven "evolution". computer viruses can in some sense be said to be generally evolving increased "intelligence" or "attack sophistication" over time.

here are some references that study the "evolution of/in malware".

• Darwin Inside the Machines: Malware Evolution and the Consequences for Computer Security Dimitris Iliopoulos, Péter Ször, and Christoph Adam

• Evolution of Malware The Evolution of Malware and the Threat Landscape – a 10-Year review / Microsoft

• An Empirical Study of Malware Evolution Archit Gupta, Pavan Kuppili, Aditya Akella and Paul Barford

• The New Trend in "Malware Evolution" / Raff (case study of "Carberp")

• the Stuxnet worm is a extraordinary case study of advanced/evolving virus features/background. U.S., Israel developed Flame computer virus to slow Iranian nuclear efforts, officials say

Answer 4

The main thing is getting it up and running. Naive versions, i.e. Taking an existing somewhat-successful piece of malware, and making every reproduction attempt have mutations, would likely be lethal to the malware in most cases.

This does not, however, mean, that it could not evolve, just that its original purpose, replication, might be hindered. With a low enough mutation rate and enough patience, beneficial and benign mutations would eventually be selected for.

One problem, however, is that they WOULD evolve. Specifically, they would evolve on pure Darwinian principles. If I write a piece of code that executes, and then, only on successful execution, copies its binary file 1000 times to 1000 locations with a random error or several in each and executes them all, it might seem like I have made replication contingent upon completing whatever task is being done successfully, but in reality, replication is only contingent upon the program THINKING it has completed that task successfully.

So there is a fair chance that if this were a piece of malware, its two basic aims, specifically, replication and screwing up people's computers, would be at odds with each other. Over a sufficiently long time, a mutation would probably arise to either make it not screw up their computers as badly, making it less important for anti-virus to deal with, thus, replicating with minimal symptoms, as is the most effective early strategy in pandemic or plague inc, or make it lie to itself that it even succeeded in screwing up their computers at all, turning the primary function into an intron fairly quickly upon it failing to execute but the replication function continuing to work.

Many people marvel at the effectiveness of the immune system in defeating all manner of threats, but in a lot of ways, computers are much, much more secure than cells. Your computer can actually just not download a virus in the first place. A perfect anti-virus system with a perfect user doesn't need to scan the hard-drive ever. Computer code cannot just be inserted physically into the hard-drive.

Contrast cells, where viruses have evolved some rather unique PHYSICAL mechanisms of slipping past cell's defenses. For example, some viruses are totally inert until they encounter a cell, but then their physical structure grabs onto and violently punctures the cell membrane to inject their genetic material. This is like a computer virus that physically cuts open your machine and adds new hardware while your OS and antivirus think "this is fine," and execute code found on that hardware.

So it is actually fairly likely that the more benign the code, the better reproduction it can do. In some cases, it might be easier for evolution to convince the user to help it than to evolve new anti-virus. I.E. appending itself to files that are likely to be shared with other users.

So ultimately, it seems more likely to me that the chance of replication is higher when it is useless as a piece of malware as such, and probably higher still if it can convince the user or anti-virus code that it is in fact something benign, important, or beneficial.

Another thing is that most machines have invalid operations, so random edits to code are likely not only to prevent functionality, but also simply cause the code to crash, even with unprotected memory.

Answer 5

Imagine non-malicious computer programs as the microbes in your gut. Imagine a computer virus as a infectious bacteria.

The computer can't tell the difference between the good bacteria and the bad bacteria, unlike the immune system.

It would be simple to make a self-modifying program, but 99% of mutations would result in an error. A program is like a list of instructions - and computers are very strict about how those instructions are written. Say we have this program:

1. Add one tablespoon of peanut butter.
2. Add one tablespoon jelly.
3. Put bread on top.

A mutation might result in this program:

1. Add one tablespoon of peahut butter.
2. Add one tablespoon jelly.
3. Put bread on top.

Although it's clear to the human it was meant "peanut", that's not clear to the computer. I could write a simple script that mutates itself in Python - but most of the time mutations will make it fail.

It would be very interested in a virus that mutated itself and could remain alive - we might even classify it as life.

---

Yes, I'm late to the party - but this is an interesting topic worth writing about.