What Are Viruses?

Viruses are a class of malicious software programs designed to replicate by attaching copies of themselves to host files or system sectors, spreading from one computing environment to another without explicit consent from users. Like their biological namesakes, computer viruses require a host to propagate: they embed executable code into legitimate programs, documents with macro support, or boot records, and activate when the host is run. The term was formally introduced in computer science by Fred Cohen in his 1984 doctoral dissertation, which provided the first mathematical definition of a self-replicating program and analyzed the theoretical limits of virus detection. Since then, viruses have evolved from isolated file-infectors on floppy disks into components of sophisticated, multi-stage cyberattacks delivered across global networks.

Viruses belong to the broader category of malware, alongside worms, trojans, ransomware, and spyware. What distinguishes viruses from worms is the need for a host file: worms self-propagate across networks without attaching to a carrier program.

Infection and Propagation Mechanisms

A virus executes its propagation routine each time an infected host program runs. File-infecting viruses append or overwrite sections of executable files in formats such as PE (Portable Executable) on Windows or ELF on Linux systems. Boot sector viruses target the master boot record or volume boot record, loading before the operating system and gaining control early in the startup sequence. Macro viruses embed in document formats that support scripting, such as Microsoft Office files using VBA, making them transmissible via email attachments. Network shares, removable media, and software distribution channels all serve as propagation vectors. IEEE Xplore research on stochastic models for malware propagation applies epidemic-style mathematical models to characterize how virus spread across connected systems can be predicted and contained.

Detection and Antivirus Techniques

Antivirus software traditionally identified viruses by matching binary patterns against a database of known signatures, a method that remains effective for cataloged threats but fails against novel variants. Heuristic analysis extends detection by flagging code that exhibits suspicious behavioral patterns, such as attempting to modify executable files or accessing protected system areas. Behavioral monitoring, sometimes called dynamic analysis, runs suspicious code in an instrumented sandbox environment and observes its runtime actions rather than its static structure. IEEE research on comprehensive malware detection and prevention techniques surveys these approaches and documents how layered defenses combining signature, heuristic, and behavioral methods outperform any single technique. Machine learning classifiers trained on feature sets extracted from binary code have further improved detection rates for previously unseen samples.

Polymorphic and Metamorphic Variants

To evade signature-based scanners, virus authors developed polymorphic viruses that encrypt their payload and alter the encryption routine with each replication, ensuring that no two copies share an identical byte sequence. Metamorphic viruses go further by rewriting their entire code body on each generation using instruction substitution, register reassignment, and code transposition, making the virus functionally identical but structurally different. These techniques directly challenge signature databases and demand more computationally intensive detection approaches. IEEE papers on machine learning algorithms for malware detection identify polymorphism and metamorphism as primary drivers of the ongoing arms race between virus writers and security researchers, and show that deep learning models trained on opcode sequences can identify family membership despite structural mutation.

Applications

Research and tools related to viruses have applications in a range of cybersecurity and computing disciplines, including:

• Endpoint protection platforms defending workstations, servers, and mobile devices
• Threat intelligence systems cataloging virus families and tracking variant emergence
• Digital forensics investigations attributing infections to specific actors or campaigns
• Security education and red-team exercises using controlled virus samples in isolated environments
• Network intrusion detection systems monitoring for propagation-related traffic anomalies