Question

Detecting a computer virus attack. Chance (Winter 2004) presented basic methods for detecting virus attacks (e.g.,Trojan programs or worms) on a network computer that are sent from a remote host. These viruses reach the network through requests for communication (e.g., e-mail, Web chat, or remote log-in) that are identified as “packets.” For example, the “SYN flood” virus ties up the network computer by “flooding” the network with multiple packets. Cyber security experts can detect this type of virus attack if at least one packet is observed by a network sensor. Assume that the probability of observing a single packet sent from a new virus is only .001. If the virus actually sends 150 packets to a network computer, what is the probability that the virus is detected by the sensor?

Short answer

Probability that the virus is detected by the sensor is 0.139.

Step-by-step solution

Given information.

The number of virus packets sent to network computer is $n=150$

The probability of observing a single packet sent from a new virus is $p=0.001$

Hence

$\begin{array}{c}q=1-p\\ =1-0.001\\ =0.999\end{array}$

Let x be the packets observed by the network sensor.

Calculating the probability that the virus is detected by the sensor. 

The probability function of the binomial distribution is given by:

${\rm P}\left(x\right)=\left(\begin{array}{l}n\\ x\end{array}\right){\left(p\right)}^x{\left(q\right)}^{n-x}$

Hence the probability that the virus is detected by at least one packet is given as:

$\begin{array}{c}{\rm P}(x\ge 1)=1-{\rm P}(x=0)\\ =1-\left(\begin{array}{l}10\\ 0\end{array}\right){\left(0.001\right)}^0{\left(0.999\right)}^{150-0}\\ =1-0.86064\end{array}$

${\rm P}(x\ge 1)=0.139$

Hence probability that the virus is detected by the sensor is 0.139