預防電腦中毒成本效益分析

Cost-effectiveness analysis of Preventing Computer Virus Infection

楊雅閔(Ya-Min Yang)

指導教授 ： 陳秀熙

共同指導教授 ： 陳俊維

國立臺灣大學/公共衛生學院/預防醫學研究所/碩士(2005年)

https://doi.org/10.6342/NTU.2005.00228

摘要

當電腦病毒感染正在全球盛行時，要降低流行性的傳染對電腦使用者是件刻不容緩的事情。而安裝防毒軟體和購買軟體的升級則必須考慮到所花的錢和時間。為了降低電腦中毒所得到的效益是否比購買防毒軟體所花的錢重要是件值得探討的問題。
就我們的瞭解，非常少的研究學者使用Anderson (1991) 傳染病模式的概念進行研究此項議題。為了在馬可夫的模式中使用Anderson的觀念，我們必須獲得許多參數，同時將參數經過轉換，因此做了一個小規模的問卷調查，而將調查所得的經驗值或專家意見應用在馬可夫的決策模型中，以進行兩種不同情景的成本效益分析。分別是兩種決策安裝防毒軟體與否，以及三種決策：購買防毒軟體同時定期更新、購買防毒軟體但並無更新、以及沒有安裝防毒軟體。
使用馬可夫決策分析可以得到如下的結果：
若效益訂為所獲得減少損失的時間，則每一單位效益相當於5小時。如此，安裝防毒軟體可以獲得3.37單位效益（16.85個小時），而沒有安裝只能獲得1.36單位效益（6.8個小時）。裝防毒軟體且每年更新可以獲得3.52單位效益（17.6個小時），而在裝防毒軟體不每年更新的狀態下，僅僅能獲得3.29單位效益（16.45小時）而已。
從消費者觀點來看，裝了防毒軟體，每要減少一個感染發生症狀的人要花新台幣38,228元。若從社會成本的觀點來看，有裝防毒軟體會比沒裝防毒軟體來的便宜且效果較好。從消費者觀點來看，裝防毒軟體且每年更新，每要減少一個感染發生症狀的人只要花新台幣26,222元，但在裝防毒軟體不每年更新的狀態下，卻要花新台幣108,158.33元。
從社會成本的觀點來看，沒裝防毒軟體比上裝防毒軟體不每年更新，每要減少一個感染發生症狀的人要花新台幣9,504.55元。從社會成本的觀點來看，若效益所獲得減少損失的時間，則每獲得5小時，防毒軟體需花費1,029元新台幣；且有裝防毒軟體比沒裝好。從消費者觀點來看，裝防毒軟體且每年更新，每獲得5小時，要花新台幣9,363元，但在裝防毒軟體不每年更新的狀態下，只要花674元。從社會成本的觀點來看，裝防毒軟體且每年更新，每獲得5小時，要花新台幣8,328元，且這個策略是較好的。
在這個研究中，裝防毒軟體且每年更新，是最有效益的策略。而安裝防毒軟體則是在預防電腦中毒上最具成本效益的策略。而我們終於成功的利用傳染病模式，發展出一個馬可夫決策模式來評估安裝防毒軟體（打疫苗）、 或購買更新的防毒軟體（追加劑）的效益或成本效益。這個模型對決定購買防毒軟體或更新的決策者是非常有用的。

關鍵字

防毒軟體 ； 成本效益分析 ； 馬可夫決策分析 ； 傳染病模式 ； 裝防毒軟體且每年更新

並列摘要

As computer virus infection prevails in the globe, to reduce pandemic transmission is of paramount importance to burden of computer users. And the installation of antivirus software (AVS) and the update of this software need considerable costs and time. Whether the benefit of reducing infection can outweigh cost incurred in purchasing AVS is worthy of being investigated.
To our knowledge, very few researches have been conducted to address this issue using the concept of infectious model as proposed by Anderson (1991). For applying the concept on Markov decision tree, we must get many parameters and do transformation, so we conducted a small questionnaire survey, then we applied Markov decision tree model to develop natural course of computer virus infection based on information obtained form empirical survey or expert opinion to perform cost-effectiveness analysis of comparing two decisions, AVS versus none, and three decisions, purchasing AVS updated at regular interval, purchasing AVS without updating, and none.
The present study used Markov decision analysis to analyze the effectiveness and cost-effectiveness analysis for prevention of computer virus infection. For effectiveness defined by reducing loss of time using 5 hr as a unit, strategy “AVS” can gain 3.37 unit utilities (16.85 hrs) in the model, but strategy “none” can only just gain 1.36 unit utilities (6.8 hrs). Strategy “Purchasing update AVS every year” can gain 3.52 unit utilities (17.6 hrs) in the model, but strategy “No purchasing update AVS every year” can merely gain 3.29 unit utilities (16.45 hrs).
For incremental cost per infected with symptoms averted, to prevent an infected with symptom, NT$38,228 would be paid in strategy “AVS” from consumer’s viewpoint. From societal viewpoint, strategy “AVS” would dominate over “none”. From consumer’s viewpoint, to prevent an infection with symptom, NT$26,222 would be paid in strategy “purchasing update AVS every year”, but NT$108,158.33 in “not purchasing update AVS every year”.
From societal viewpoint, to prevent an infection with symptom, NT$9504.55 would be paid in strategy “none”. If effectiveness is defined by utility gained in reducing loss of time, to gain 5 hrs, NT$1,029 would be paid in strategy “AVS” from consumer’s viewpoint. From societal viewpoint, strategy “AVS” would dominate over “none”. From consumer’s viewpoint, to gain 5 hrs, NT$9,363 would be paid in strategy “Purchasing update AVS every year”, but NT$674 in “not purchasing update AVS every year”. From society viewpoint, to gain 5 hrs, NT$8,328 would be paid in strategy “Purchasing update AVS every year”, and “none” is dominated
In this analysis, purchasing update AVS every year would be most effective strategy in preventing computer virus infection. And AVS used would be most cost-effective strategy in preventing computer virus infection. And we finally successfully developed a Markov decision model underpinning the infectious disease model to evaluate effectiveness or cost-effectiveness of installing AVS (vaccination) or purchasing the updated AVS (booster). This model is very useful for policy-maker in the determination of whether AVS or regular update is necessary.

並列關鍵字

AVS ； cost-effectiveness analysis ； Markov decision analysis ； infectious model ； purchasing update AVS every year

參考文獻

Aron, J. L., M. O'Leary, et al. (2002). "The benefits of a notification process in addressing the worsening computer virus problem: Results of a survey and a simulation model." computers & Security 21(2): 142-163.

Highland, H. J. (1997). "Procedures To Reduce The Computer Virus Threat." Computers & Security 16(5): 439-449.

Jones, A. R. (1992). Development and delivery of a computer security strategy for a community of end users. User Services Conference

Post, G. and A. Kagan (1998). "The Use and Effectiveness of Anti-Virus Software." Computers & Security 17(7): 589-599.

Anderson, R. M. and R. M. May (1991). Infectious diseases of humans-dynamics and control, Oxford university press.