Computer Answers

Increase your PageRank

(email) leonard.wilson2008@hotmail.com

Yahoo Instance Messanger leonard.wilson2008

(fax) 888-406-2958

Keywords

monitor taste

Keywords
l

cd monitor

monitors

monitor

computer monitors

lcd monitor 17

19 lcd monitor

Keywords

monitor taste

Keywords
l

cd monitor

monitors

monitor

computer monitors

lcd monitor 17

19 lcd monitor

Computer and information security breaches have been a serious threat to the information technology (IT) industry (McClure, 2001; Whitman, 2003). This threat has resulted in dramatic financial losses. Despite the continued efforts of government and industry toward the defense against malicious codes, both the number of attacks and the resulting financial losses continue to increase (Gordon, Loeb, & Richardson, 2006). The CIS/FBI survey estimated the amount of loss due to virus contamination was $15,691,460 (Gordon et al., 2006). The term "virus" is often used generically to refer to viruses, worms and other forms of malicious code (malware). Sophos defines a virus as "a computer program that copies itself" (www.sophos.com). A virus requires a host program and will not infect a computer until the host program has been run. In this article, the generic term virus refers to virus code, worms, Trojans, and all other forms of malware. While exact numbers are not available, it is estimated that there are over 100,000 viruses in existence in today's computer information systems. Sophos (www.sophos.com) reported that there were 15,907 new malware threats identified during 2005 alone. Virus attacks shows a strong positive correlation with its costs, and denial of service, unauthorized access, and net abuse (Li, Wei, Lai, & Koong, 2004). Problems and objectives Kephardt and White (1991) proposed a theoretical model using an epidemiological model of infectious diseases to study computer viruses. Kephart, Chess and White (1993) defined the epidemiological approach as "characterizing viral invasions at the macro level--has led to some insights and tools that may help society to cope better with the threat (and which may aid the study of biological viruses, too)." This article uses a macro level analysis of the life cycle of viruses to help to develop an understanding of how they behave in the environment. An extended discussion of the epidemiological approach to virus analysis can be found in Serazzi and Zanero (2003). A qualitative understanding of the epidemiology of computer viruses has been developed (White, 1998) and a quantitative analysis of the evolving attacks patterns and exploits used by viruses (Coulthard & Vuori, 2002) has been done. An early approach to defining a virus's life cycle is the Internet Worm Propagation Data Model (IWPDM) (Mcalerney, 1999) which defined the life cycle as having four phases, starting with an activation phase and ending with a death phase. Between these two phases are a series of hibernation and reactivation phases. These would comprise the visible portion of the virus's life cycle. The complete life cycle would include a development phase prior to the activation phase and an epilogue phase where the author(s) are, hopefully, apprehended, tried in criminal court and possibly incarcerated. The development and epilogue phase are not considered part of the visible portion of the virus life cycle due to incomplete and inaccurate data and the lack or relevance to the understanding of the behavior of the virus while it is in the wild. The emergence/disappearance rates and the duration of the active attack period of viruses are not well documented. This emergence, disappearance, and the duration of active infection comprise the visible portion of virus life cycle. A large number of viruses are developed in a laboratory setting as a proof of concept or as a test of a possible exploit. These are never released into environment so there is no need to directly control them and they often have a very abbreviated and hidden life cycle. In many cases, a patch is developed and released to remove the exploit prior to any attacks taking place. The focus of this article is only on those viruses in the general computing environment or "in the wild." The reasons for limiting the focus to those viruses "in the wild" is the abbreviated and often hidden life cycle of the virus while it is in the laboratory. Additionally, it is desirable from an analytical perspective to identify those viruses that passed a real life test as to its virulence and persistence. The ability to compare viruses with varying levels of virulence and persistence should aid in the identification of the characteristics that were the source of its virulence and persistence. Once the mechanism of the attack is understood, hopefully a defense can be developed. The viruses have been the leading attack sources for the duration of this study and are predicted to remain as the leading attack sources in the future (Gordon et al., 2006). A detailed understanding of virus patterns may provide insights that can be used to develop defenses against these attacks. The objective of this research is to aid information system staffs, executives, directors, and managers or supervisors in business and government in a better understanding of virus threats, enabling them to improve their decisions on how to cope with these threats. METHODOLOGY Data on the number of incidents and on different types of viruses are available from Sophos (www.sophos.com), IBM research (www.ibm.com), Vmyths (vmyths.com), McAfee (www.mcafee.com), Kaspersky Labs (www.kaspersky.com), the Wildlist (www.wildlist.com), Symantec (www.symantec.com) and many other antivirus vendors and research organizations. When compared with other vendor's databases, the Sophos database showed a more complete set of information on the viruses for the longest period. This information included reports for every month during the period of analysis with the percentage or share for each virus for each month. The ratings from Sophos have similar patterns as those from the other companies. The article includes a detailed comparison of the Sophos data set and the data available from Kaspersky Labs. The Sophos database was selected for the current article because of its completeness and duration. A total of 230 viruses based on monthly top 10 virus data reports from January 1998 to December 2005 were extracted from Sophos' Web site (www.sophos.com) for use in this article. The monthly top 10 virus data reports were compiled from the numbers of virus code submissions from Sophos' customers to the Sophos research center. The top 10 virus list encompasses 75% of all of the reported virus incidents during the period (For details regarding a summary of the monthly share data obtained from Sophos for each virus type for the period of January 1998 through December 2005, please contact the authors). During the period from January 1998 to December 2005, a total of 230 viruses were identified as appearing in the top 10 at least once. Three phases of analysis were used to study the visible portion of the viruses' life cycle. Initially, a pattern analysis was conducted to look at the overall picture in terms of the relationship between the total number of reentry and maximum shares for each virus. Cluster analysis was then performed to investigate similarities in the patterns of each virus entering and leaving the top 10. Further cluster analysis was then done with the high impact viruses identified from the second phase to further refine their classifications. In the first phase, the study and investigation of the overall virus pattern, three variables were identified: the total time the virus stayed in the top 10 ranks of shares (months) (X1), the total numbers of times reentering top 10 ranks (X2), and the maximum share (%) for all reentries (X3). The total number of reentering top 10 rank (X2) for a particular virus is counted as two entries if that virus appeared for two months, then disappeared for one month, then appeared again. In the second phase, the investigation of the details of reentering pattern for each virus, 15 variables (X4-X18) were identified in order to conduct grouping based on cluster analysis. X4 refers to the duration from the first (new) entry to the first time it leaves the top 10 ranks (months); X5 refers to the duration from the first leave to the second entry into top 10 ranks (months). This pattern of assignment was repeated for 8 entries and exits. This pattern can be seen graphically in Figure 1. Even numbered variables, shown above the time line, indicate when a virus was in the top 10 rankings. Odd numbered variables, shown below the time line, measure the number of months between entries into the top 10. Each virus was assigned a unique sequence number that was also used as its identification number upon its initial entry to the top 10. In the third phase, further analyses on the high impact viruses or "bad actors" detected from the second phase were conducted on average shares, total shares, and life spans (X1). FINDINGS Analysis of the Visual Portion of Virus Life Span The analysis in this article addresses the relationship between the total number of months of in top 10 ranks (X1) and two factors: total number of reentering top 10 ranks (X2) and the maximum shares (highest percentage) (X3) for each virus. Our relationship study utilized a multiple linear regression model. The analysis focuses on what kind of virus will stay longer (i.e., the number of months that a virus presents in top 10, X1) at top 10. By doing linear regression analysis, as we expected, each virus tends to experience a peak and then a dying process. In other words, it doesn't matter how large the maximum share a virus is, it will eventually disappear from the top 10. Two contributing used in the classification and understanding of the virus life cycle were the number of re-entries of a virus into top 10 (X2) and the strongest impact (measured by the maximum percentage) (X3) of a virus' whole life. Figure 2 displays the relationships between the numbers of months a virus staying at top 10 (X1) and the numbers of re-entries (X2). Figure 2 displays a clear increasing pattern, which is as expected. On average, the larger the number of reentries of a virus, the longer the virus' visible life span. Figure 3 represents the relationship between X1 and the strongest impacts (X3) of each virus. The pattern in Figure 3 is not that clear. Points inside the marked area show a strong positive relationship between the life spans and maximum impacts. However, the points outside the marked area can substantially weaken such relationships. A multiple linear regression line addressing the effects from the number of re-entries (X2), the maximum impacts (X3), and the interaction between the two toward a virus' lifespan (X1) is fitted to the data. To validate the assumptions for a linear regression model (Kutner, Nachtsheim, Neter, & Li, 2004), we used the natural logarithm transformation for the number of months that a virus stays at top 10. The model is: [MATHEMATICAL EXPRESSION NOT REPRODUCIBLE IN ASCII] where [[beta].sub.m], m = 0, ..., 3, are the coefficients of the linear regression line and [[epsilon].sub.i], i = 1, ..., n, are the errors. Table 1 gives the statistical inferences for the coefficients [[beta].sub.m]. The small P-values indicate that there is a significant relationship between life spans and the three variables, which are the number of entries, the maximum impact, and the interaction of the two. The estimated coefficients clearly indicate that there is a positive relationship between life spans (X1) and the number of re-entries (X2). There is also a positive relationship between life spans (X1) and the maximum impacts (X3). This supports the findings that on average, if a virus enters more frequently, the virus will have a longer life span; and that the higher the maximum impact a virus has the longer the life span of the virus. However, the small value of the estimate of b2 indicates that the observations outside the marked area in the above figure somehow weakened the relationship between life spans and the maximum impacts. In order to visualize how the number of entries and the maximum impact interact with each other to affect the life span of a virus, a three-dimensional picture was plotted based on the fitted regression model. Figure 4 shows that the effect from the number of entries gets weaker if the maximum impact is large; the effect from the maximum impact gets weaker when the number of re-entries is large. This observation implies that when the number of re-entries is small, the life span of a virus is highly affected by the value of the maximum impact; when the maximum impact of a virus is low, the life span of a virus is highly affected by the number of entries; when either one of the two variables gets large, the effect from the other gets smaller. Phase II: Grouping Analysis Based on Cluster Analysis Cluster analysis is a descriptive technique that allows for the grouping of observations based on the similarity of their characteristics. The goal is to create a number of clusters that are relatively homogeneous in their characteristics and with significant differences between the clusters. If the cluster analysis is done with a large and varied enough data set new observations should fit into an existing cluster. The revealed pattern will help people in computer sciences find a way to keep them from occurring again. However, cluster analysis is unable to predict the individual behavior of any new observations. In our investigation of the details on virus re-entering and leaving top 10 ranks cluster analysis was performed on the 230 viruses that were members of the top 10 viruses in a month. Several cluster analysis methods exist, including hierarchical and k-means methods. FASTCLUS cluster procedure in SAS is used to find disjoint clusters of observations using a k-means method. The k-means method is especially suitable for large data sets (SAS, 2003). Cluster analysis was performed on the 230 observations (viruses) that entered the top 10 within a month and 15 entry/exit pattern variables (X4-X18). A range of 3 to 8 different numbers of clusters was examined. Six clusters provide most reasonable classifications using the cubic clustering criterion. Table 2 summarizes the virus classifications based on cluster analysis. Further analysis of the data within each of the groups based on the 1-month share of the reported incidents is contained in Table 3. A seventh cluster was created to assist in the understanding of the impact of each cluster. It is identified as cluster 0 with its members encompassing of all of the reported viruses that did not enter the top 10 at any time. There is very little data available on this seventh cluster other than its total contribution to the overall virus problem. The most significant findings in Table 4 relate to the dominance of the "one-hit-wonders" and the unexpectedly large impact of viruses in cluster 4. Clusters 0, 1, 2, and 3 basically form a "one-hit-wonders" super cluster that makes up 78.7% (181 of 230) of the viruses in the top 10 and 56.45% of all reported viruses during the period under examination. Technically, clusters 2 and 3 allow two entries, but an examination of the individual members indicated that there is very little difference in the actual impact and behavior of these viruses. The other significant finding is that cluster 4 which had 15 members or 6.7% of the members of the top 10, accounted for 22.08% of all of the reported virus incidents. Phase III: Further Analysis of the High Impact Viruses The viruses with the highest impact, groups 4, 5 and 6, were combined for further analysis. The names of these viruses and their ID numbers are presented in Appendix A. The 43 members of this group provided for 43.67% of all reported viruses during the 7-year period of the analysis (1998-2005) while comprising only 18.7% (43 of 230) of the viruses that made the top 10 list. The purposes of this additional analysis were to identify the characteristics of these high impact viruses. A cluster analysis was done for 1) the number of months in the top 10, 2) the average share, and 3) the total share. In each case, the group broke into 3 subgroups. Table 5 contains the results of this analysis. A univariate analysis of each group was performed to identify its basic parameters. Table 6 contains the univariate descriptors of each of the groups. A coefficient of correlation was calculated to identify any relationships that might exist between the variables. The coefficient of correlation: between the average share per month and the number of months was 0.3997; between the total share and the number of months was 0.7986; and between the average share and total share was 0.8780. All of these results have a reasonable amount of "face validity" because they follow known patterns in the business world. One would expect that as the average share increases so would the total share. The same applies with the relationship between the number of months and the total share. The longer a virus persists, the higher its total reported share would be. The authors believe that the primary contribution of this additional analysis is the identification of three groups of high impact viruses. Further in-depth analysis of these particular viruses would aid in the development of strategies to counter-act their "cousins" in the future. Data Validation Because the data collected by Sophos is a partially self-selected sample of the people who purchased the Sophos product and from the members of the Sophos research team who monitored the Internet, the validity of the data set needs to be established. Founded in 1985, Sophos offers commercial and individual protection products against viruses. Product research and analysis is done in Sophos' high-security research laboratories located worldwide, including in the UK, USA, Canada, and Australia. The information is then posted on its Web site. Over 35 million individuals and organizations of all sizes already used Sophos' products and Web site. Based on literature review for the top 10 antivirus software companies worldwide, only two companies, Sophos and Kaspersky, were identified as providing monthly updates with market shares on virus threats. Because monthly data from Kaspersky (www.Kaspersky.com) was only available for a shorter period of time, it was used to validate the primary data set from Sophos. Fragmentary data is available from a number of other sources, but they are all incomplete as to the number of months provided or the data available. The available data from Kaspersky covered the period starting in November 2001 through December 2005. The same period was extracted from the Sophos data and compared with Kaspersky's data set based on Cluster Analysis and Virus Life Span Analysis. DATA VALIDATION Based on Cluster Analysis The results from a cluster analysis based on two data sets are presented in Table 7. T-Tests were conducted to establish if the distributions were similar. The t-test score for the counts by cluster was 0.1908 indicating that the hypothesis of a common mean and distribution can be accepted at a 99% confidence level. Additional testing was conducted to establish if the percentages of reported virus incidents were similar between the two data sets. For cluster 1, the result of the t-test was 2.2119, which indicated that the hypothesis of the two sources of data having the same proportion of viruses belonging to the first cluster could be accepted but only at a 90% confidence level. The results for clusters 2 through 5 were 1.07, 0.93, 1.06 and 0.89 respectively. These results indicated that the hypothesis of the same proportion of viruses in each cluster could be accepted at a 99% confidence level. Because there were no members of the 6th cluster in the Kaspersky data set, no testing was done. Data Validation Based on Virus Life Span Analysis Based on virus life span analysis of two data sets, similar relationships were found between life spans and numbers of re-entries, and between life spans and the maximum impact of a virus. Figure 5 shows the relationship between life spans and numbers of re-entries of a virus, and Figure 6 shows the relationship between life spans and maximum impacts based on the data set from Kaspersky. These two Figures showed similar patterns to the ones given by Figures 2 and 3. Using the regression model that was developed for the primary data set the reduced data set was evaluated. The original model was: ln([lifespan.sub.i])=[[beta].sub.0] + [[beta].sub.1] *[entry.sub.i] + [[beta].sub.2] *max_[impact.sub.i] + [[beta].sub.3] *[entry.sub.i] *max_[impact.sub.i] + [[epsilon].sub.i] where [[beta].sub.m], m = 0, ..., 3,, are the coefficients of the linear regression line and [[epsilon].sub.i], i = 1, ..., n, are the errors. Table 8 gives the similar statistical inferences for the coefficients [[beta].sub.m] as those in Table 1. Because the sample size of the second data set (from Kaspersky) is small, there are not many points outside the marked area. Therefore, points inside the marked area will mostly determine the relationship, which is a strong positive relationship between the life spans and maximum impacts. The evidence from the analysis of the structure of the two data sets, the pattern analysis and the regression analysis indicates that the Sophos data set is a valid sample that can be further analyzed to establish what the life cycle of malicious code. The Sophos data set was selected for this further analysis because it covers a longer time period than the Kaspersky data set. Effects of Truncation of Virus Life Cycle on Life Cycle Classification Viruses introduced prior to January 1998 or during the latter portion of 2005 would have the possibility of having several values outside the collection period, resulting in the truncation of their life cycle. This truncation had the effect of censoring the additional data that might have been obtained if the viruses' full life cycle were available. To identify the effects on the analysis, a subset of the data set composed of the observations from 1999 through 2004 inclusive was created. The data from 1998 and 2005 was used to identify which clusters a virus belonged to, thus eliminating the effects of truncating the life cycle of an individual virus. This reduced data set has 186 observations compared to the original 230 in the complete data set. Table 9, a summary of the complete data set, and Table 10, a summary of the reduced data set, allow for comparison between the data set on the maximum share of the reported incidents within a given month. When comparing the univariate descriptors there is very little difference between the data sets. Therefore, this truncation is not assumed to be a significant issue in the analysis. DISCUSSIONS AND CONCLUSION By studying the patterns of viruses, this article aims to provide a larger picture and understanding of virus attacks. To achieve this objective the 230 most prevalent viruses from January 1998 to December 2005, as reported by Sophos, were analyzed. The analysis was conducted using the virus patterns based on 17 virus pattern variables including life spans, numbers of reentry, maximum shares, and entry/reentry patterns. Specifically, there are a number of major findings that are discussed below. The investigation of the impact of number of entries (X2) and maximum shares (X3) on lifespan (X1) showed that when the number of entries (X2) is small, the life span (X1) of a virus is highly affected by the value of the maximum impact (X3); when the maximum impact (X3) of a virus is low, the life span (X1) of a virus is highly affected by the number of entries (X2); when one of the two variables (X2 and X3) gets large, the effect from the other variable gets smaller. This supports the finding that on average when a virus enters more frequently, the longer the life span of the virus, and the higher the maximum impact a virus gives the longer the life span of the virus. Cluster analysis identified five life cycle patterns of reported virus incidents. These can be combined into three "super clusters" to develop a managerial response to the threat. The first super cluster, the "one-hit-wonders," is responsible for 62.61% of all of the reported incidents. The second super cluster is cluster 4, which is composed of a very small number of very persistent and nasty viruses. Cluster 4's 15 members comprised only 6.52% of the total top 10 viruses, but accounted for 22.08% of all of the virus reports. The final super cluster could be called repeat offenders. It is composed of clusters 5 and 6. This super cluster has 28 members and accounted for 22.17% of the incidents. The managerial implications are that an ongoing antivirus program needs to be in place to counter the continuing low-level threat posted by the members on the one-hit-wonder super cluster and a crises response policy to limit the effects of the Cluster 4 and "repeat-offenders." Clusters 4, 5, and 6 were combined to allow for further analysis of the high impact viruses. These viruses, the really bad actors, comprise a relatively small portion, 18.70% (43 of 230) of all the reported viruses. However, they account for 43.67% of all virus reports for the 7-year period of the study. The "bad actors" can be further subdivided into three groups with a very high impact group of 5 viruses being the worst of the worst. There are some statistical problems with generalizing the conclusions because the data used in not a random sample of the population of all viruses on the Internet. The sample may have a bias because it is self-selected by those people who purchased Sophos software and then allowed reports of the attacks on their machines to be reported to Sophos for analysis. The data set posted by Sophos is from a very large number of reporting sites because there were more than 10 million copies of their product in use for each year of the reported period. The pattern of the visible portion of the viruses' life cycle and the classification was similar when the data set was available from both Kaspersky and Sophos. Both of the conclusions about the relationship between maximum share, duration, and number of re-entries to the top 10, and the small number of very significant viruses hold for both the Sophos and Kaspersky data sets. The two independent data sets validate each other but it is difficult to state with certainty that these conclusions hold true for behavior of the entire universe of viruses "in the wild." Anecdotal evidence from practitioners and network administrators support these conclusions, but again they cannot be applied to all viruses "in the wild" with certainty. Even though the virus data analysis in this article covers a large sample and is collected by a leading antivirus company, the results of the research should still be interpreted with several limitations. First, the virus data is collected only from reported virus organizations and individuals. As with all data collected, the nonreported rate might be a problem. Second, there are some factors that might affect the analysis of virus attacks; such as antivirus technologies developed (Wei & Li, 2004) and the changes in legal environments. Third, the data analyzed in this article covered the period from January 1998 to December 2005: the entry/reentry of a particular virus outside this time span is not shown in this article. However, an analysis of a reduced data set, 1999 to 2004, was conducted and the results indicated that the loss of portions of the visible life cycle on both ends of the period did not significantly affect the results. The authors believe that this is the first step in a larger study. The study is a post ante analysis of virus life cycle patterns and impacts. As such it is more descriptive than prescriptive. Additional study needs to be done to identify the internal design and mechanisms so that techniques such as AI (pattern recognition (e.g., neural networks, decision trees, etc.) and state-full inspection can be developed to identify new viruses as they are introduced and to block or minimize their effects. Further research might be conducted to investigate relationships between life span and other factors in order to understand life spans of viruses more deeply. Investigation into other factors may provide critical information enabling users to halt virus re-entry. Distinguishing the patterns between novel pieces of malicious codes and the numerous variants that are released is an additional research direction. REFERENCES Coulthard, A., & Vuori, T. A. (2002). Computer viruses: A quantitative analysis. Logistics Information Management, 15(5/6), 400-409. Gordon, L. A., Loeb, W. L., & Richardson, R. (2006). 2006 CSI/FBI computer crime and security survey. Retrieved November 30, 2007, http://www.gocsi.com Kephardt, J., & White, S. (1991). Directed-graph epidemiological models of computer viruses. In Proceedings of the IEEE Computer Society Symposium of Research in Security and Privacy, Oakland CA, (pp. 343-359). Kephart, J. O., Chess D. M., & White, S.R. (1993, May). Computers and epidemiology. IEEE Spectrum. Retrieved November 30, 2007, from http://www.research.ibm.com/antivirus/SciPapers/ Kephart/Spectrum/Spectrum.html Kutner, M. H., Nachtsheim, C. J., Neter, J., & Li, W. (2004). Applied linear statistical models (5 ed.). McGraw-Hill. Li, Y., Wei, J., Lai, L., & Koong, K. (2004). Implications of technologies and financial losses on information security. In Proceedings of the ISOneWorld, Las Vegas. McAlerney, J. M. (1999). An Internet worm propagation model. Retrieved November 30, 2007, from www.cs.usdavis.edu/research/tech-reports/2005/CSE-2005-10.pdf McClure, D. (2001). Guarding your gateway. Association Management, 53(8), 60-6. SAS. (2003). SAS menu. SAS Corporation. Serazzi, G., & Zanero, S. (2003). Computer virus propagation models. In Tutorials of the 11th IEEE/ACM International Symposium on Modeling, Analysis and Simulation of Computer and Telecom. Systems--MASCOTS 2003. Retrieved November 30, 2007, from http://citeseer.ist.psu.edu/serazzi03computer.html Udelson, T. (2000). How secure is your network? Association Management, 52(6), 25-6. Wei, J., & Li, Y. (2004). Forecasting on information systems attack sources. In Proceedings of the Information Resources Management Association, New Orleans. White, S. R. (1998, October 22). Open problems in computer virus research. In Proceedings of the Virus Bulletin Conference, Munich Germany. Whitman, M. (2003). Enemy at the gate: Threats to information security. Communications of the ACM, 46(6), 91-95. Wilcoxon, F., & Wilcox, R.A. (1964). Some rapid approximate statistical procedures. Pearl River, NY: Lederle Laboratories. Yaffee, R. (2000). Introduction to time series analysis and forecasting with applications of SAS and SPSS. Academic Press. June Wei, University of West Florida, USA Randall C. Reid, University of West Florida, USA Hongmei Zhang, University of South Carolina, USA June Wei is an assistant professor of management information systems (MIS) in the Department of Management and MIS at the University of West Florida since Fall 2003. She earned an MS from the Georgia Institute of Technology and a PhD from Purdue University. She worked as a software engineer in telecommunication and network sector for more than five years in Dallas, Texas. She is a guest editor of International Journal of Mobile Learning and Organization. She has published papers extensively and is an editorial board member of the journals such as Interdisciplinary Journal of Knowledge and Learning Objects, Journal of Information Privacy and Security, Interdisciplinary Journal of Information, Knowledge and Management, International Journal of Management and Enterprise Development, and International Journal of Mobile Learning and Organization. Randall Reid joined the faculty of UWF in the fall of 2003. He previously taught at the University of Alabama in Huntsville and Bowling Green State University. He received his PhD in MIS from The University of South Carolina in 1993. He also has an MBA from the University of South Florida, and a BA and MA from the University of Florida. He also holds a CISA (Certified Information System Auditor), CISSP (Certified Information Systems Security Professional), Security+, A+, and Network+ professional certifications. His primary research and teaching interests are in the networking and security areas. Hongmei Zhang is an assistant professor of statistics at the University of South Carolina. She earned a PhD in statistics from the Iowa State University. She is a member of Mathematical Association of America (MAA) and American Statistical Association (ASA). Her research interests are in applied statistics. Table 1. Statistical inference for coefficients Estimates P-values [[beta].sub.0] -0.2791 0.0055 [[beta].sub.1] 0.6027 <0.0001 [[beta].sub.2] 0.0348 <0.0001 [[beta].sub.3] -0.0063 0.0300 Table 2. A summary on virus classification analysis Cluster Numbers Virus Patterns Frequency Percent % 1 Enter once with the total time in 144 62.61 the top 10 less than or equal to 4 months 2 Enter twice with the total time in 27 11.74 the top 10 less than or equal to 4 months 3 Enter once or twice with the total 16 6.96 time in the top 10 between 5 and 9 months inclusive 4 Enter once or twice with the total 15 6.52 time in the top 10 greater than or equal to 10 months 5 Enter the top 10 three or four 23 10.00 times 6 Enter the top 10 five or more 5 2.17 times Table 3. Maximum 1-month share of reported incidents Max Shares Cluster 1 Cluster 2 Cluster 3 Average 7.3 7.8 20.7 Min 1.0 2.0 4.3 Max 51.1 77.8 77.6 Std Dev 9.9 14.8 19.2 Max Shares Cluster 4 Cluster 5 Cluster 6 Average 32.9 15.2 18.7 Min 4.0 5.0 6.0 Max 92.4 71.2 40.0 Std Dev 26.5 13.8 13.6 Table 4. Total shares of all reported incidents Total Shares Cluster 0 Cluster 1 Cluster 2 Cluster 3 Sum 2457.3 1605.0 465.4 1035.6 % of total 24.90 16.30 4.73 10.52 Average N/A 11.6 17.2 64.7 Min N/A 2.2 6.2 19.9 Max N/A 70.5 120.0 234.0 Std Dev N/A 13.2 21.7 54.9 Total Shares Cluster 4 Cluster 5 Cluster 6 Sum 2174.8 1501.6 614.4 % of total 22.08 15.25 6.24 Average 145.0 65.3 122.9 Min 26.8 12.1 33.8 Max 327.8 159.7 356.5 Std Dev 98.0 43.1 134.6 Table 5. Clusters formed from the analysis of number of months, average share, and total share Cluster on Numbers Clusters on of Months Average Shares Month Number of Average Average ID Number * Cluster Months Cluster Share 20 1 4 1 5.63 27 1 6 1 4.85 29 1 3 1 5.6 30 1 6 1 3.33 32 1 7 1 5.43 35 1 5 1 5.78 37 1 3 1 4.03 38 1 6 1 3.1 1 2 13 1 5.52 6 2 12 1 5.18 12 2 10 1 2.68 13 2 13 1 3.97 15 2 10 1 3.11 21 2 8 1 5.74 33 2 11 1 5.65 34 2 10 1 5.36 43 2 10 1 3.38 18 1 6 2 6.25 9 3 15 1 5.35 42 3 14 1 2.95 19 2 8 2 6.06 26 2 8 2 9.13 41 2 11 2 5.98 36 1 6 3 10.63 25 2 12 2 7.12 4 3 16 2 8.79 10 3 18 2 6.63 17 3 16 2 6.31 24 3 18 2 6.35 28 3 16 2 6.38 16 3 15 2 9.21 22 3 14 2 8.02 23 3 19 2 8.41 2 2 10 3 12.32 5 2 13 3 13.91 31 2 9 3 13.13 40 2 11 3 10.64 3 3 15 3 10.31 7 2 12 3 20.72 14 2 13 3 20.39 8 3 21 3 13.86 11 3 18 3 18.21 39 3 23 3 15.5 Clusters on Total Shares Total Share Total ID Number * Cluster Share 20 1 22.5 27 1 29.1 29 1 16.8 30 1 20 32 1 38 35 1 28.9 37 1 12.1 38 1 18.6 1 1 71.8 6 1 62.1 12 1 26.8 13 1 51.6 15 1 31.1 21 1 45.9 33 1 62.2 34 1 53.6 43 1 33.8 18 1 37.5 9 1 80.3 42 1 41.3 19 1 48.5 26 1 73 41 1 65.8 36 1 63.8 25 2 85.4 4 2 140.6 10 2 119.4 17 2 100.9 24 2 114.3 28 2 102.1 16 2 138.2 22 2 112.3 23 2 159.7 2 2 123.2 5 2 180.8 31 2 118.2 40 2 117 3 2 154.6 7 3 248.6 14 3 265.1 8 3 291 11 3 327.8 39 3 356.5 Note: * Id Number and name listing can be found in Appendix A Table 6. Univariate descriptors of the groups from the second series cluster analysis Number of Months Average Share Cluster Cluster Cluster Cluster Cluster Cluster 1 2 3 1 2 3 Count 10 19 14 19 13 11 Mean 5.20 10.74 17.00 4.56 7.28 14.51 Standard 1.40 1.73 2.66 1.15 1.24 3.78 Deviation Total Share Cluster Cluster Cluster 1 2 3 Count 24 14 5 Mean 43.15 126.19 297.80 Standard 19.95 25.85 44.39 Deviation Table 7. A comparison of virus classification between Sophos and Kaspersky Sophos Data 11/01-12/05 Cluster Numbers Virus Patterns Count % 1 Entry only once with the total time 88 19.17% in the top 10 less than or equal to 4 months 2 Enter twice with the total time in 8 3.31% the top 10 less than or equal to 4 months 3 Enter once or twice with the total 14 14.25% time in the top 10 between 5 and 9 months inclusive 4 Enter once or twice with the total 10 28.09% time in the top 10 greater than or equal to 10 months 5 Enter the top 10 three or four times 5 3.21% 6 Enters the top 10 five or more times 2 0.19% Kaspersky Data 11/01-12/05 Cluster Numbers Virus Patterns Count % 1 Entry only once with the total time 91 10.23% in the top 10 less than or equal to 4 months 2 Enter twice with the total time in 13 1.54% the top 10 less than or equal to 4 months 3 Enter once or twice with the total 11 14.56 time in the top 10 between 5 and 9 months inclusive 4 Enter once or twice with the total 11 48.66% time in the top 10 greater than or equal to 10 months 5 Enter the top 10 three or four times 8 3.19% 6 Enters the top 10 five or more times 0 0% Table 8. Statistical inference for coefficients based on Kaspersky's data set Coefficients Estimates P-values [[beta].sub.0] -0.4426 0.0034 [[beta].sub.1] 0.7744 <0.0001 [[beta].sub.2] 4.4247 <0.0001 [[beta].sub.3] -1.0435 0.1116 Table 9. Complete data set (1998-2005) Max share 1 2 3 4 5 6 Count 144 27 16 15 23 5 Average 7.3 7.8 20.7 32.9 15.2 18.7 Min 1.0 2.0 4.3 4.0 5.0 6.0 Max 51.1 77.8 77.6 92.4 71.2 40.0 Std Dev 9.9 14.8 19.2 26.5 13.8 13.6 Table 10. Reduced data set (1999-2004) Max share 1 2 3 4 5 6 Count 110 21 15 15 20 5 Average 7.8 8.8 10.6 32.9 16.4 12.7 Min 1.0 2.0 1.0 4.0 5.0 5.0 Max 51.1 77.8 77.8 92.4 71.2 40.0 Std Dev 10.3 16.7 14.4 26.5 14.5 9.6 APPENDIX A. LISTING OF THE HIGH IMPACT VIRUSES FROM 1998-2005 Id Maximum Months in Average Total Number Virus Name Share Top 10 Share Share 1 CMOS4 8.30 13 8.30 13.00 2 WM 97/Class 26.00 10 26.00 10.00 3 W32/Apology-B 29.80 15 29.80 15.00 4 W32/Magistr-A 27.40 16 27.40 16.00 5 W32/Sircam-A 65.20 13 65.20 13.00 6 W32/Magistr-B 16.10 12 16.10 12.00 7 W32/Badtrans-B 92.40 12 92.40 12.00 8 W32/Klez-H 67.00 21 67.00 21.00 9 W32/Netsky-B 20.20 15 20.20 15.00 10 W32/Netsky-D 30.20 18 30.20 18.00 11 W32/Netsky-P 35.20 18 35.20 18.00 12 W32/Netsky-Q 4.00 10 4.00 10.00 13 W32/Netsky-Z 5.80 13 5.80 13.00 14 W32/Zafi-B 59.20 13 59.20 13.00 15 W32/MyDoom-O 7.20 10 7.20 10.00 16 WM/Cap 20.70 15 20.70 15.00 17 Form 11.40 16 11.40 16.00 18 Parity Boot 6.30 6 6.30 6.00 19 Anticmos 11.70 8 11.70 8.00 20 New Zealand-i 5.00 4 5.00 4.00 21 WM/CopyCap 13.90 8 13.90 8.00 22 W95/CIH-10xx 14.80 14 14.80 14.00 23 WM97/Ethan 17.40 19 17.40 19.00 24 W32/Ska-Happy99 14.80 18 14.80 18.00 25 WM97/Melissa 12.00 12 12.00 12.00 26 W32/Pretty 25.60 8 25.60 8.00 27 W32/Qaz 7.10 6 7.10 6.00 28 W32/Hybris-B 13.70 16 13.70 16.00 29 W32/Verona-B 5.00 3 5.00 3.00 30 W32/Bymer-A 5.00 6 5.00 6.00 31 W32/Nimda-A 71.20 9 71.20 9.00 32 W32/Klez-E 13.50 7 13.50 7.00 33 W32/ElKern-C 23.70 11 23.70 11.00 34 W32/Yaha-E 16.80 10 16.80 10.00 35 JS/NoClose 7.50 5 7.50 5.00 36 W32/Gibe-F 23.50 6 23.50 6.00 37 W32/Bagle-Zip 5.00 3 5.00 3.00 38 W32/Netsky-C 5.00 6 5.00 6.00 39 XM/Laroux or 40.00 23 40.00 23.00 XM97/Laroux 40 WM97/Marker-A 23.60 11 23.60 11.00 41 WM97/Marker-C 14.20 11 14.20 11.00 42 W32/Flcss 6.00 14 6.00 14.00 43 W32/Nimda-D 9.90 10 9.90 10.00

Every Wednesday, the dismissal bell rings two hours early at Quest to Learn, a New York City charter school for grades 6-12 centered around digital-game-inspired teaching methods. Although the students are done for the day, the learning is just beginning for the teachers. That&#x2019;s when they go into professional-development overdrive.

&#x201C;When we were creating the program, we knew that it was going to be something that we were going to have to take the responsibility in educating our teachers about,&#x201D; says Arana Shapiro, the director of curriculum, instruction, and technology integration for the school.

Whether teachers are in a school like Quest to Learn or a traditional classroom, providing professional development to address the challenges presented by transitioning to game-based teaching and learning methods is essential to supporting effective instruction, experts say.

Locating and undergoing the training necessary to integrate games into the classroom is difficult, however, and that fact poses an obstacle to the widespread adoption of this type of teaching.

&#x201C;[Game-based instruction] is very challenging, especially for teachers who have been teaching for a long time in one way and are learning to do something in a different way,&#x201D; says Shapiro. &#x201C;The teachers that we have here are very aware that this model takes time to fully understand.&#x201D;

Pockets of Training

The training began at Quest to Learn before the school opened last fall, and has continued during the weekly two-hour Wednesday blocks, called Studio Q.

&#x201C;It&#x2019;s a time that we try to encourage teachers to talk about their practice, learn about their practice, and to be able to ask questions about the practice. We want to create a community that is open, trusts each other, and isn&#x2019;t afraid to make mistakes in front of each other,&#x201D; says Shapiro.

But most teachers interested in game-based learning do not receive training as systematically, experts on instructional technology say.

&#x201C;Right now, I think most of the professional development comes from workshops and conferences and word-of-mouth,&#x201D; says Richard Van Eck, a professor of instructional design and technology at the University of North Dakota, in Grand Forks, who teaches educators how to use digital games with their classes.

Very few teachers receive any training about how to incorporate games into learning during their initial schooling, he says.

Jabari Mahiri, a professor in the graduate school of education at the University of California, Berkeley, recently spent a year observing high school teachers who underwent professional development to infuse technology--everything from using blogs to spending time in virtual worlds--into their instruction.

&#x201C;The teachers reported very little, if any, training from their teacher-preparation or professional-development programs [in] ... integrating technology effectively into instruction,&#x201D; he writes in his forthcoming book Digital Tools for Urban Schools: Mediating a Remix of Learning.

Similarly, James Mathews, a social studies and life-skills teacher at Middleton Alternative Senior High School in Wisconsin, says most teachers receive their introduction to game-based instruction at conferences.

&#x201C;They have &#x2018;A-ha!&#x2019; moments while they&#x2019;re at the conference, but when they go back to their classroom, there&#x2019;s not necessarily an infrastructure set up for them to continue working on that,&#x201D; he says.

Fortunately for Mathews, his school is located in one of the hotbeds of games research, he says. &#x201C;As somebody in this community, I had ample resources.&#x201D;

More opportunities for hands-on practice and learning are needed before teachers can reach the level of comfort necessary for effective integration of games, simulations, and virtual worlds into education, says Jorian Clarke, the chief executive officer of the Circle 1 Network, which hosts a child-centric virtual-world website called KidsCom.com.

Learning to Play

Getting teachers to familiarize themselves with games and spend time playing them is the first step in learning how to use them to teach, says Van Eck, from the University of North Dakota.

Knowing what&#x2019;s in each game and how it relates to the lessons being taught in class is essential to using games in education, he says.

If teachers want to use a commercial game for educational purposes, starting with a cheat sheet or walk-through of the program, which can usually be found through an online search, can help them learn how the game works without having to actually spend time playing it from beginning to end, says Van Eck.

But even with such detailed guidance, turning a game into a lesson &#x201C;is a tremendous amount of work upfront,&#x201D; he says. Most teachers who use games to teach log dozens of hours of preparation after school and on weekends, says Van Eck.

When properly integrated, though, games can be engaging and effective learning tools, says Brock R. Dubbels, a graduate instructor at the University of Minnesota-Twin Cities.

&#x201C;Games, by their very nature, assess, measure, and evaluate,&#x201D; he says. &#x201C;When used in the correct way, they can actually increase subject-matter knowledge as well as help students to build higher-order thinking skills.&#x201D;

Part of learning how to teach with games is rethinking the role of the teacher in facilitating student learning, Dubbels says. Though students may learn on their own while playing a game, he says, having a teacher to guide discussions and draw connections between the game and lesson is imperative.

&#x201C;Games by themselves are very appealing, ... but if there&#x2019;s nobody to help the learner connect with the concept or process or vocabulary, then it&#x2019;s often just latent knowledge,&#x201D; says Dubbels.

Kurt Squire of the University of Wisconsin-Madison agrees.

&#x201C;Students have a difficult time inferring what&#x2019;s happening in game play and connecting that to broader ideas that you might be discussing in class or that the teacher has presented,&#x201D; says Squire, an assistant professor in the educational communications and technology division of curriculum and instruction.

While teacher training may be hard to come by, educators shouldn&#x2019;t overlook one important resource: students, says Maryanne Berry, who teaches English at Cardinal Newman High School, a private Roman Catholic school in Santa Rosa, Calif.

&#x201C;We&#x2019;re all waiting for professional-development programs to emerge, but in the meantime, it&#x2019;s really good to use students as guides and resources,&#x201D; she says.

Gale Document Number:A229982052

flat screen monitors