Prior to the COVID-19 pandemic, viruses were not a daily topic of conversation beyond infectious disease experts and trained virologists, yet viruses are now the daily talk across the planet. At the same time, computers across the globe are subject to attack by their own viruses and malware. The medical and software engineering professions both invest exorbitant resources in fighting these respective attacks — so it is perhaps surprising that the deep parallels between the two have often gone unnoticed.

Computer systems of today are continually monitored, with each program providing the appropriate telemetry data needed for monitoring agents to accurately determine the internal health and performance of running programs. Based on this telemetry, an automated system can provide notification of a performance issue that requires programmers to make necessary changes to the software. This also includes scanning for exploits by hackers who may install harmful viruses that must be detected and neutralized.

Virus detection in computer programs is primarily implemented using a signature-based technique, where it searches a database of known virus “signatures,” as virtually all viruses have unique digital markers that can be detected in a running program. Anti-virus programs scan the bytes of code in each program looking for that signature, and if found in a program it will either delete the program, move it into quarantine, or disinfect it if possible. In relation to biological organisms, the concepts of monitoring and telemetry closely resemble attacks on biological organisms by exogenous microscopic predators, requiring a highly complex system of defenses far more complex than computer systems built by humans. Here I will focus on specific parallels between vertebrate immune systems and mechanisms used by computer programmers to protect computer systems.

An Ingenious Mechanism

Individual cells of vertebrate organisms protect themselves from a variety of microscopic enemies through an ingenious mechanism. On the surface of these cells, molecular “antennae” continually present a “readout” of the internal proteins performing work inside, up to perhaps ten thousand. These molecules are called major histocompatibility complex (MHC) class I molecules, or MHC class I for short. MHC molecules display small protein fragment peptide “signatures” (typically 8-11 amino acids in length) from within the cell. Each of these peptide signatures is a type of antigen, which can be either the host cell’s “self” (good) or foreign (bad) antigens. The process of presenting these antigens, whether good or bad, on the surface of a cell is called antigen presentation. Foreign antigens, which would be the result of viruses or bacteria that have invaded the cell, signal externally that the cell has been infected. Also presented are tumor antigens, which represent formerly “good” proteins that have mutated and are now bad (i.e., potentially cancerous cells).

Antigens presented on the surface of infected cells by MHC molecules can be noticed by circulating cytotoxic (“cyto” as in cell and “toxic” as in poison) CD8+ T cells. These T cells routinely patrol the body of a vertebrate in extracellular fluid monitoring for these antigens, looking for signatures in the array of peptides that are not normally produced by the cell. When antigens for a virus or bacteria are found, T cells know the cell has been infected by foreign or mutated proteins and kick off a process of programmed cell death for cells that it now deems as potentially harmful. Ideally, if the immune system kills enough infected cells early on, this can prevent surrounding cells from being infected. We see something similar with viruses in computer systems. When a virus is detected, the infected program can be quarantined and repaired so it won’t spread the virus to other programs or computers or can be removed entirely if it cannot be repaired.

Computers and Organisms

Now what is different about the handling of viruses by computer systems as opposed to biological organisms in this endogenous (i.e., generated from within the cell) antigen scenario is that in the case of an infected computer program, the entire program is scanned linearly looking for a virus signature, whereas in the biological case, the cell effectively pre-filters the telemetry data before providing it to T cells. In the case of a virus or bacteria infecting the cell that can kill it and other cells that surround it, the cell has signaled something is wrong, and so it is now up to the T cells to induce apoptosis (i.e., the programmed death of the cell) thus sacrificing the cell to the benefit of the overall organism.

In another parallel of antivirus programs and biological organism immune responses, just as antivirus programs must be continually updated with new virus signatures by consulting a database (which you may notice happens every few days when Windows updates its virus protection program), biological organisms are also updated after an encounter with a pathogen such as a virus. After the first time a T cell encounters a new antigen, it will begin to replicate itself into two types of cells: memory and effector T cells. The memory cells are long-living and become members of an effective database of T cells that each “remember” a specific antigen for the next time the organism is exposed to that antigen, being at the ready to crank out effector T cells that will perform the work of killing infected cells.

As I mentioned previously, the immune response for endogenous antigens is but one of multiple lines of defense in biological organisms and is a remarkable mechanism exhibiting the hallmarks of design. In the future, I hope to examine other aspects of the vertebrate immune system which is still an area of exciting scientific discovery because there is still much to learn due to its astounding complexity.