= Eugene H. Spafford
{c}
\b[Eugene H. Spafford] researches <computer security> and analyzed the <computer worm> that disrupted Internet systems in November 1988. His technical report reconstructed the program's behavior using independent reverse-compilations and a disassembly, connecting observed failures with weaknesses in the affected systems.<The Internet Worm Program: An Analysis by Eugene H. Spafford>[Primary title-page byline and Abstract, incident and evidence used in the analysis]{ref}
The historical program copied itself between vulnerable machines running versions of <Unix>. Its disruption illustrates a security failure involving computation and connectivity, even without defining the event solely by altered user <files>. Spafford's analysis treated program behavior, system assumptions and possible mitigations as related parts of the explanation.<The Internet Worm Program: An Analysis by Eugene H. Spafford>[Abstract, propagation, disruption and review of security flaws]{ref}
An original resource model separates stored-data correctness from <service availability>. Suppose legitimate work requires 25 percent of a <CPU>'s capacity, and each unwanted running copy requires another two percent. Twenty copies demand $0.25+20(0.02)=0.65$ of capacity; 40 demand $1.05$. In this stipulated model, the latter demand exceeds what that <CPU> can supply, so some work must wait or fail. No changed document is required for users to lose timely service. These invented loads are an explanatory model, not measurements of the 1988 incident.
Reconstructing what a <computer program> did therefore supports a more precise security claim than merely observing that a machine became slow. The tested resource and the evidence for the failure mechanism must both be stated.
\Image[https://www.cs.purdue.edu/people/images-landscape/faculty/spaf.jpg]
{title=Eugene H. Spafford, named portrait in Purdue University's Department of Computer Science profile}
{height=300}
Back to article page
