Computer viruses exhibit many similarities with biological viruses. Thus, a closer examination of this association might lead to some new perspectives and, even, to new enhanced capabilities that will facilitate the overall effort to tackle and, why not, eradicate them. Game theory has long been considered as a useful tool for modeling viral behavior. In this paper, we establish certain, important we hope, correlations between a well-known virus, namely VirLock, with the bacteriophage $\phi6$. Moreover, following this line of thought, we also suggest efficient and, at the same time, practical strategies that may significantly alleviate the infection problems caused by VirLock and any other virus having similar traits.

Keywords:: Game theory, computer virus, VirLock, biological virus, $\phi6$, polymorphic code.

§ INTRODUCTION

§.§ Computer viruses

The term computer virus is an extremely common term that is used when referring to malicious computer software. This metaphorical term is based on the observation that biological viruses’ behavior and malicious software’s behavior have much in common and share some conceptual characteristics <cit.>.

Biological viruses have many different variations just like their digital counterparts. Computer viruses have several traits that help in their categorization, usually based on traits regarding their behavior and infection mechanisms. The way computer viruses get to infect the host computer also helps in their classification <cit.>, <cit.>. Traits like their target demographic, their operational conditions, replication manners, infection mechanisms, infection success rate, the consequences and their severity, and many other traits are what differentiate them from each other and help in their categorization and research.

A computer virus must initially infect the target computer to interact with the host for the first time and start its replication process. In those cases where the virus implements traits like polymorphic, or metamorphic code, or a worm component, the virus’s ability to spread appears to be somewhat unpredictable.

It is not necessary for worms to manipulate the target computer software in order to replicate <cit.>. Unless they consume a significant amount of the computer's resources, their presence will be hinted at by the slow performance. Worms remain active in the computer memory and their actions are typically unseen by the user. The most intriguing aspect of worms and viruses with worm components is not just their capacity for rapid self-replication, but also that they can do that without the host computer user’s interaction, known as the zero-click type <cit.>, <cit.>.

Specific types of computer viruses have the potential to mutate, which in turn leads to better spreading of their population and better infection rates while generally improving their already existing traits. Mutating is a trait found in viruses with polymorphic and metamorphic code. Polymorphic code usually makes use of variable encryption to encrypt itself in order to make unique copies.

The goal of employing polymorphic and metamorphic code is to avoid detection by antimalware and antivirus technologies. Implementing the “metamorphic trait” in a virus is typically harder than the “polymorphic trait.” However, the implementation cost may be worth the extra work because it provides superior protection against antivirus technologies, and evading detection is considerably easier.

§.§ Biological viruses

Biological viruses are parasitical organisms that gain the ability to reproduce and carry their genetic material, proteins, and DNA or RNA, by infecting a host. They translate their RNA into proteins that serve them by using the host’s ribosomes since they do not have the ability to synthesize proteins of their own. Viruses can be transmitted through different means, depending on their species. “Host range” is what the number of cells that get infected by a virus is called. Usually, the way that a biological virus gets dealt with is by the immune system of the organism it has infected. Infected organisms could be molecules, animals, plants, as well as humans. Moreover, a good means of defense and a way of helping the immune system is the use of vaccines, often used to work against a specific virus. Other than vaccines, there are also antiviral drugs that are evolving more and more as time passes.

When a virus infects a cell, it forces it to directly replicate itself, creating more copies of said virus. What makes up a virus is its genetic material, what is called the capsid, a set of proteins that protect said genetic material, and sometimes external lipids. The extracellular form of the virus is called the virion. Depending on whether they have a DNA or an RNA genome, the viruses are classified in two types (DNA & RNA virus respectively). The genetic material of an RNA virus is made up of ribonucleic acid (RNA) <cit.>. A virus can have a lot of different effects on an organism. Causing the death of the host cell is what most of them do. Usually, they do that by using viral proteins to restrict the normal activity of the cell. The effects that some viruses have may lead to permanent damage to the host organism or they may be destroyed without malignancy. Some viruses can infect an organism without causing any changes in the cells. So, the cells can continue to function normally even when infected, yet they still end up causing the infection to spread persistently. The set of viruses that an organism gets infected by, is called a virome. A common method used to trace the source of infections is phage typing <cit.>.

Viruses do not get transmitted through cell division, since they are acellular organisms. Instead, they get transmitted by using the host to create multiple copies of themselves. The host is forced to reproduce the original virus when infected. Viruses have a basic life cycle. The infection starts once a virus attaches itself and its proteins to the surface of the host. That is when the cell type and host range get determined. After that, virions penetrate into the cell. Bacteria do not have a strong protective wall and mechanisms for gene penetration have been developed in viruses, while the capsid does not leave the outside of the cell. Eventually, the virus gets released into the host cell through the Uncoating process <cit.>. When the virus is replicated the genome is also multiplied. After they replicate, altered proteins and particles may appear relative to the original form of the virus before the penetration occurred. The process that happens so that a virus can be released from a host cell is called lysis. Once this happens the cell is killed. The process the host uses to reproduce, so the virus can also be replicated, is called a prophage. Once the virus stops being inactive, lysis happens in the host cell. RNA viruses’ reproduction takes place in the cytoplasm. Each specific virus uses the enzymes it has in order to make copies of the genomes. The virus has the ability to infect a new host cell after lysis, which leads to this cycle repeating itself. Moreover, the virus might mutate during this step <cit.>. After the immune system of an organism detects a virus, it begins the production of antibodies so that it can suppress the virus. The name of this process is humoral immunity. Whether the body has gotten rid of the virus or not, depends on the antibodies that have been produced.

Viruses that can diverse or alter microbial populations are called bacteriophages or phages and because of those properties they have been used as antibacterial agents <cit.>. The host range that some bacteriophages have is focused only on one bacterial strain. Bacteriophages infect specific bacteria and are a group of viruses. More often they have double-stranded RNA genomes. RNA viruses consist of segments that make up a protein. Such segments are found in the capsid. Different segments can exist in different virions and the virus can be contagious nonetheless. They infect by attaching themselves to the molecules on the surface of the bacterium, and after that they enter the cell. Oftentimes, once the original virus enters the cell, it starts translating its mRNA into proteins. After that, the result of this process could help in the process of cell lysis or it could become a virion and help in creating other virions. Virus enzymes assist in destroying the cell membrane. Usually, bacteria use enzymes that can target unknown RNA to protect themselves from this type of infection. Bacteria also have the ability to detect the genomes of viruses that have encountered in the past and they can block their reproduction by interfering with the RNA. This is a means that bacteria use to protect themselves from this kind of infection. Bacteria can naturally interfere with the RNA. While a viral RNA is being replicated, certain mutations happen, which could either leave the cell proteins unaffected or contribute to the resistance against antiviral drugs.

§.§ Game theory

There exists a tool that can, potentially, assist in modeling the behavior of such viruses and, consequently, may pave the way for the development of a higher level of protection. This tool is game theory and in its extension evolutionary game theory (EGT for short). Its relations and applications to realistic scenarios are what make this concept even more captivating <cit.>. Observations at the microscopic level are just as fascinating as the macroscopic ones. Even in the biological processes, game properties have been observed as well as in multicellular organisms like cells and macromolecules (see <cit.> for an accessible overview). All of them seem to follow certain strategies, as the observation of their moves implies. Of course, during a time span, a player’s strategy can change as a result of natural selection. When mutations happen during the cell’s lifespan, reversible or irreversible changes to their strategies can take place due to epigenetic modifications. All of the aforementioned are connected to the reproduction ways of the objects at hand, and it is clear that reproductive success affects the game’s final result.

A synopsis of evolutionary games in the context of biological systems is given in <cit.>. The use of games in biology is a significant and ongoing trend. Numerous traditional games, including the well-known Prisoner’s Dilemma, have been employed to simulate biological circumstances (see <cit.> and <cit.> for references). This extends beyond viruses to include microorganisms and their games and even bio-inspired computational models (see <cit.> and <cit.> for further details). The study of biological processes stands to gain new perspectives and insights with the introduction of unorthodox tools like games, automata, and quantum mechanics. For instance, applying game theory concepts to the science of quantum computation has shown to be incredibly fruitful (see <cit.>, <cit.>, <cit.> and <cit.> for some recent results and more related references). It is worth noting that games, despite their playful facade, may tackle serious, even critical problems. For instance, coin tossing plays a crucial role in the design of quantum cryptographic protocols (see <cit.> and references therein, and the more recent <cit.> and <cit.>).

Contribution. Through the correlation of computer viruses to their biological counterparts, this paper aims to offer fresh perspectives and advocate for a new, hopefully promising, vein of research. In this work we build upon the preliminary investigation of <cit.> and we demonstrate that the association of the behavioral traits of biological viruses and computer viruses is not only possible, but also fruitful. The particular focus of this research is on VirLock, a ransomware-type computer virus, and its similarities to biological viruses with an initial focus on the well-documented and studied $\phi6$ bacteriophage virus. Our approach culminates in a thorough examination and analysis of the main similarities and anticipated differences between these two viruses. In addition to improving the variety of tools for evaluating the efficacy of the strategies employed to counter the viruses, we anticipate that this approach will shed new light on the adoption and application of strategies that in the end, have proven efficient in combating certain virus types. Of course, there are numerous types of computer viruses, and the same is true for the biological ones. However, we believe that the analytical approach adopted here, can easily generalize and prove helpful in tackling more general scenarios.

§.§ Organization

This paper is organized as follows. Section <ref> gives an introduction to the subject along with some relevant references. Sections <ref> and <ref> provide a concise introduction about the VirLock virus, and explain how it can be modeled using game theory, respectively. An extensive comparison of VirLock with $\phi6$ is presented in Section <ref>, while Section <ref> is devoted to a rigorous mathematical analysis. Finally, Section <ref> summarizes and discusses the prospects of this approach.

§ THE VIRLOCK VIRUS

VirLock is a computer virus that when it manages to infect the victims computer encrypts the majority of the user's precious files while essentially locking their system. Then, demands a ransom from it's victims in order to offer them access back to their system and data. This behavior is what classifies this virus to the, now rising, ransomware group of viruses. VirLock is usually spread through cloud storage and exhibits parasitic behavior as it infects certain supported computer files. From the time it executes in the host computer, it begins to infect the supported files. It is noteworthy that the way it alters the files slightly differs from what is normally observed from similar types of malware. Instead of embedding malware within clean code, VirLock embeds clean code within malware. This implies that every encrypted file will be embedded into the malware. The file then functions as a VirLock mutation, and it can be used to further infect and spread through populations.

In 2014 the first VirLock detection took place <cit.>. Naturally, as the virus is polymorphic, numerous distinct mutations have been discovered throughout the course of many years, up until the present. Differences in VirLock's core functions as well as the decoration-code were discovered as it continued to evolve. VirLock is capable of propagating through networks and due to the growing popularity of cloud storage nowadays, which VirLock takes advantage of, it was able to achieve better spreadability.

VirLock has the ability to take over the entire screen area of the computer and terminate the Windows explorer.exe process, which controls the graphical user interface <cit.>. By the time it infects the computer, it has been rendered nearly unusable because there is no way to access the operating system's core features as the virus message covers up the entire screen while binary files and files with specific extensions are “encrypted” in the background. In certain VirLock variants, the user's geolocation is also breached and based on it VirLock is able to display special lock screen messages that pretend to be local authorities instead of a generic one <cit.>. This helps persuade the user even more that the message is legit and that they should cooperate. While all the above take place, the user is unable to utilize antivirus software in the traditional manner. The best technique to attempt and clean a computer from VirLock, as advised by several antivirus vendors, is to boot into the safe mode with network capabilities that Windows OS provides or use a VirLock cleaner that some specific companies provide along with manuals for the disinfection operations to get up to that point. These strategies will probably prevent VirLock from launching itself at startup. If the OS boots up properly, and the OS files are not “encrypted,” the user can try to disinfect the computer by running a virus scan with an antivirus or antimalware software. The type of VirLock variant that infected the host will obviously affect the likelihood of successful detection and removal of the virus, as it is quite likely that a new variant may not be recognized yet.

As previously mentioned, for known VirLock variants, certain companies provide a VirLock cleaner <cit.> that claims to be able to remove the virus's leftovers and “decrypt” the majority (if not all) of the infected files. The user is warned that false positives might also be detected and should proceed with caution. Others even suggest a cloud access security broker that could protect the cloud storage by setting limits on certain activities and/or breaking connections when needed <cit.>, <cit.>. VirLock’s numerous variants are what sometimes challenge antimalware software, it seems that analyzing the behavior of this type of malware would be most effective in its detection and prevention.

Live behavioral analysis capabilities in antivirus solutions provide a distinct advantage in combating such types of viruses. Mutations are not completely different from the core code as they retain certain traits. The core behavior and infection strategy, in many cases, appears to remain the same if it is not altered by a third party. It is possible that the level of protection can be increased by focusing on the way viruses react to scenarios. There are various mutations and variations of VirLock in the databases of most digital security companies. Data from the well-known website virustotal suggest that the virus's mutations and variations have different detection rates from a variety of anti-virus software. In virustotal VirLock can be seen under the names PolyRansom.B, Nabucur.A (the letter after the dot declares the variation and different ones can be seen), Win32.Cryptor and more (some of the results can be found in <cit.>, <cit.>, <cit.>). Even though behavioral analysis from antivirus and antimalware software is considered important, there are still ways that VirLock evades their emulations by employing techniques like payload encryption and generic obscure code <cit.>, <cit.>.

The best practical approach to protect against such type of infection is to keep regular backups of at least the files that are of critical importance. Measures that could also help avoid infection and further transmission are network segmentation and keeping antivirus software up to date <cit.>, <cit.>. As aforementioned, another great proactive measure that could protect against VirLock and similar attacks is the use of a cloud access security broker. Though due to the complexity set-up that most of those services require it does not appear to be the best solution for maximum payoff to users with little computer knowledge. On the other hand, a known exploit of VirLock and, easy getaway to safety in case of an infection, is its disregard for Windows' volume shadow copies. Therefore, the harm can be undone if this feature of Windows OS is enabled in order to recover to a previous back-up <cit.>. Security specialists have also found out that VirLock has a flaw that can be exploited. By entering 64 zeros in the description key field, it is possible to trick VirLock that the ransom has been paid <cit.>. After that, by clicking a file, the decryption process is activated, the victim has to manually extract the original file. The drawback of this strategy is that the user will have to do this for every single file in the computer, with the risk of infecting the computer once again. The process should be done by moving the recovered files to an external drive and then formatting the one with the infected files.

Some well-known ransomware tends to use one-way encryption algorithms like RSA or AES. VirLock on the other hand does not, and instead it performs a two-stage “encryption” process making use of XOR and XOR-ROL operations <cit.>. Of course, if algorithms like RSA or AES were utilized entropy would turn out to be much higher. Even though VirLock’s mechanism is not really considered encryption, in this paper we will refer to these operations of the virus as such. The infection occurs when the user attempts to run the infectious file. By the time it is executed it drops 3 randomly named executables in random folders. Older variants of the virus appear to drop only 2 of them according to sources. The executable drops appear to carry different hashes as they are polymorphic <cit.>. One of them disguises itself as a Windows service, while the others encrypt and infect the computer's files. The task manager process is also disabled providing an extra layer of protection to the virus, preventing the user from taking control and killing the virus process that attempts to alter the Windows registry.

grow to left by = - 1.50 cm,
grow to right by = - 1.50 cm,
colback = white,
enhanced jigsaw,

sharp corners,

toprule = 1.0 pt,
bottomrule = 1.0 pt,
leftrule = 0.1 pt,
rightrule = 0.1 pt,
sharp corners,
center title,
fonttitle = ]

This figure illustrates the VirLock cloud storage spread and infection. In the example above, the user of the top right computer opened a malicious email attachment that caused the PC to get infected with the VirLock malware. The files in the cloud storage that the computers in the network share will also get infected. The malware may eventually spread to other machines in the network, if they interact with it. The blue arrows represent interaction with the cloud, while the red ones show the route of the infection.

The structure of these types of files is the following: polymorphic code appears at the begging as well as the end of the code that changes in every iteration/infection. Polymorphic code is essentially “wrapped” around the main code blocks. This part of the code is also referred to as “decoration code” as it “decorates” the main code with operations like random API calls from random modules. The malicious code, which runs every time, appears after the first piece of polymorphic code and it is usually the same among different variations of the code. Right after the malicious code, VirLock embeds the encrypted data of the original file it infected, often referred to as “clean code.” The last piece of polymorphic code appears at the end of the code <cit.>, <cit.>, <cit.>. In case of an infection, it is possible that the user might be tempted to pay the ransom rather than getting involved in disinfection operations that might appear complicated. There are several major reasons why one should reconsider making the ransom payment. First and foremost, there is a compelling ethical justification, especially in light of the exorbitant price the ransomware may demand. Second, according to a number of sources <cit.>, just 8% of those who pay the ransom successfully recover the grand total of their data. Ransomware counts on the desperation of its victims to get their data back, pushing them to the ransom payment strategy. Of course, as it appears, there are other significantly more efficient ways for victims to get their data back, while achieving a high pay-off as players.

§ MODELING VIRLOCK WITH GAME THEORY

It is gainful to acquire a clearer picture of the strategies that benefit the user the most in case of an infection from VirLock by employing game theory tools to model various scenarios. Based on the general consensus among security experts and information from <cit.> that “96% of those whose data was encrypted got their data back in the most significant ransomware attack,” and that “only 8% (of those who paid) got all their data back” the payoff matrix that follows can be constructed. This confirms that there are other, more effective methods of recovering the data besides paying the ransom. The following game theory matrix pictures a scenario where the a user who got infected by ransomware has to decide whether paying the ransom or not is worth it.

grow to left by = - 1.50 cm,
grow to right by = - 1.50 cm,
colback = white,
enhanced jigsaw,

sharp corners,

toprule = 1.0 pt,
bottomrule = 1.0 pt,
leftrule = 0.1 pt,
rightrule = 0.1 pt,
sharp corners,
center title,
fonttitle = ]

Game theory payoff matrix of the ransom payment. The VirLock malware may or may not decrypt the users' data (or at least not in its entirety), and on the other hand, the user has the choice of paying or refusing to pay the ransom. The above payoff matrix makes it apparent that paying the ransom payment will generally result in advantageous position for the malware's creator(s) and that doing so entails extra risks.

The game pictured above may appear to be simple, but it's a helpful introduction to the concept. In this game the VirLock malware as well as the user of the computer are considered to be the players. The user has two possible moves and so does VirLock. The user can choose to pay or not to pay the ransom and VirLock can “choose” to decrypt or not to decrypt the files. VirLocks' moves are technically predetermined since usually there is an algorithm that offers the user the decryption key but we can still roughly calculate the possible outcomes of the scenario. While keeping in mind the aforementioned statistics we have improvised on the payoff outcome of every strategy combination. The max payoff is considered to be $100$. For the user, $100$ means that all his files were decrypted without losing any money (which does not appear here since we don't consider certain disinfection techniques but only ransom payment). For VirLock $100$ means that the entirety of the ransom was paid. We consider that the data is at least of some importance.

Each table cell represents the outcome of the game after the players have picked their corresponding strategies. On the top left cell we have the statistically improbable case where the files are decrypted while the user doesn't pay. This case can be considered as a failure of VirLock to encrypt the data or the user employed a proactive strategy so no damage was taken from the attack. Because of that the payoff for the user was taken to be $100$ since not only no money was spent but all the data were unaffected while tackling the attack and preventing further spread. On the other hand, in the bottom left cell we have the case where the user doesn't pay and VirLock doesn't decrypt. This could be considered a neutral state but in reality if VirLock managed to already encrypt the data the user is in a disadvantage. Of course, based on the criticality of the data and the possible disinfection techniques per case the negative number could go even lower, meaning bigger loses for the user. We will further demonstrate the effects of such factors in the following sections.

On the top right block, the user chooses to pay the ransom and VirLock decrypts the files. As the available statistics suggest, only a portion of the data is usually getting decrypted. Moreover, considering that the ransom is quite high, the user benefits only in theory, since usually not all files are rescued, and only some of the data are recovered, despite the significant amount paid.
Again, considering the importance of the files the payoff is proportionate to the cost of money and the criticality of the data that are now encrypted. The benefit could even go bellow $0$ depending on the circumstances. The last bottom left cell represents the case where the users pays the whole ransom and VirLock does nothing to decrypt the data or a second infection takes place from user error or VirLocks' inability. In this case the users loses everything in the context of this game with cost $-100$ while VirLock gets it all ($100$). Analyzing certain scenarios that way, can provide a better insight and understanding of the actual costs and the benefits of strategy combinations between players.

§ COMPARISON OF VIRLOCK WITH $\PHI6$

It is of considerable interest, and may also yield new insights, to compare the properties of biological and computer viruses and how they behave during and after the invasion of the host. Computer virus types continue to evolve in tandem with the development of computers, just like their biological counterparts. Biological viruses mutate and when they do, generations can be observed over time. In a similar fashion, computer viruses may also mutate and replicate themselves or can be altered by a third party. To follow this metaphor even further, we may correlate the immune system of a bacterium to the antivirus software and other security software installed on a computer as well as other digital security properties (like privileges, actions, settings et.c.). By infecting the victim's computer files (which in this case could represent the cells of a bacterium that get infected from a biological virus), computer viruses attempt to weaken the computer's “immune system” in order to replicate themselves and increase their population. In addition to the above, VirLock and worm-type viruses try to infect more than just a single individual and spread their population through the network of computers, which in turn can be correlated to a population of bacteria in close proximity. As we attempt to compare and correlate computer viruses with their biological counterparts we decided on a representative of each group. We deemed the bacteriophage $\phi 6$ as a great representative of the biological viruses since it has been extensively modeled in terms of its behavior and structure, and has previously been associated with the field of classical and evolutionary game theory.

§.§ The pseudomonas virus $\phi6$

Bacteriophage $\phi6$ lytic virus is a member of the cystoviridae family infecting Pseudomonas bacteria. Specifically, that type of virus infects legume-infecting bacteria. It's double-stranded genome consists of twelve protein codes and three segmented parts. A lipid membrane covers the nucleocapsid of such species. With its unique protein, named P$3$, designed for this function, $\phi6$ finds the bacterium that it wishes to infect and then sticks to it. In addition to the protein above, many other proteins participate in the process of cell infection. $\phi6$ bacteriophages compete with each other to gain capsid proteins in their common bacterial targeted host. When different strains of phi-6 bacteriophages are assembled, with varying numbers of bacteriophage particles that can simultaneously infect a single bacterial cell, different results are obtained. The result of infection of the bacterial cell by the virus directly depends on the combination and proportions that will be chosen in the populations of phage and bacteria. A strain can infect a cell alone, or infection of the cell can result from a combination of viruses and their counterparts or even their mutations <cit.>.

The behavior of the bacteriophages, as well as the role that each one will take and whether they will cooperate with their neighbors or show selfish behavior plays a catalytic role in the fitness of the population against the virus. $\phi6$ is found in cases of polymorphism mix with helper viruses, for the purpose of ESS of the game. Some behaviors are interpreted with the help of the prisoner's dilemma and others with the help of the snowdrift game (also called the chicken game) with different results each, depending on the ratio of infecting viruses to bacterial cells <cit.>.

The main properties and characteristics of VirLock that could be linked to bacteriophages and especially $\phi6$ are the following:

grow to left by = 0.00 cm,
grow to right by = 0.00 cm,
colback = GreenLighter1!03,
enhanced jigsaw,

sharp corners,

toprule = 1.0 pt,
bottomrule = 1.0 pt,
leftrule = 0.1 pt,
rightrule = 0.1 pt,
sharp corners,
center title,
fonttitle = ]

* They are self-replicating viruses that appear to grow rapidly.

* They try to protect themselves by attacking and eventually manipulating the host.

* They affect the host in order to gain full access to its functions and keep their viral ability unaffected.

* They affect certain host types.

* They exhibit parasitic behavior, while manipulating and embedding their code in their replicants/mutants.

* They are able to spread when the infected parts come in contact with other hosts.

* They have a core structure that is subject to change.

* They are able to mutate rapidly not only by themselves but also with external help.

* They can be untraceable for a specific time; they are, in general, hard to locate and extremely difficult to eliminate.

Table <ref> summarizes the main thesis of our approach regarding the fundamental correlation between computer and biological viruses. Tables <ref> and <ref> elaborate on the main similarities and differences between VirLock and $\phi6$, respectively.

grow to left by = - 0.25 cm,
grow to right by = - 0.25 cm,
colback = gray!03,
enhanced jigsaw,

sharp corners,
boxrule = 0.1 pt,
toprule = 0.1 pt,
bottomrule = 0.1 pt
This table presents the hypothesis regarding the correlation between computer and biological viruses in general.

2cGeneral correlation hypothesis

Computer networks

PC in a computer network

Individual in a city or country

Infected files in a computer system

Infected cells in a human organism

Security software and properties (e.g. antivirus, privileges, actions)

Immune system of a human individual

grow to left by = - 1.00 cm,
grow to right by = - 1.00 cm,
colback = gray!03,
enhanced jigsaw,

sharp corners,
boxrule = 0.1 pt,
toprule = 0.1 pt,
bottomrule = 0.1 pt
This table highlights the similarities between VirLock and $\phi6$

Infects certain file extensions (.xls, .doc, .pdf, .rtf, .psd, .dwg, .cdr, .cd, .mdb, .lcd, .dbf, .sqlite, .jpg, .zip)

Pseudomonas bacteria

Polymorphic code, mutations in iterations

Polymorphism/mutations to virus & host cells

Replicates after infection

Replicates after infection

Embeds clean code inside malware

Alters the RNA of host ribosomes into proteins that serve them

Antivirus & antimalware

Immune system, RNA interference

VirLock cleaner

Vaccines & antiviral drugs

Permanent damage to files (damage to the computer is avoidable)

Permanent damage to host cells

Infected files can also infect

Infected cells can also infect

grow to left by = - 1.00 cm,
grow to right by = - 1.00 cm,
colback = gray!03,
enhanced jigsaw,

sharp corners,
boxrule = 0.1 pt,
toprule = 0.1 pt,
bottomrule = 0.1 pt
This table highlights the differences between VirLock and $\phi6$.

E-mail, transfer infected file, cloud

Virus enzymes

Multiple attributes

P12 proteins with different attributes

Polymorphic code, malware code, clean code, polymorphic

RNA, Capsid, Virion

The following Tables <ref>–<ref> describe the steps of some of the most prominent strategies that users can follow in order to recover their computer back to a normal functioning state. The rationale behind the following tables is to get an overall sense of the complexity inherent in each step, as well as the effectiveness and the risks that it entails in order to get a better insight of the overall costs and benefits that could be used in this type of game.

grow to left by = 0.50 cm,
grow to right by = 0.50 cm,
colback = gray!03,
enhanced jigsaw,

sharp corners,
boxrule = 0.1 pt,
toprule = 0.1 pt,
bottomrule = 0.1 pt
This table shows the complexity of VirLock recovery strategies.

4cRecovery strategy complexity

Complexity (out of $10$)

Risk of reinfection

Ransom payment

Decrypt taking advantage of VirLock's flaw

Recovery using shadow volume copies

High (depends)

Simple malware removal with antivirus software

Virus removal and special cleaner (antivirus + cleaner)

grow to left by = - 0.25 cm,
grow to right by = - 0.25 cm,
colback = gray!03,
enhanced jigsaw,

sharp corners,
boxrule = 0.1 pt,
toprule = 0.1 pt,
bottomrule = 0.1 pt
The recovery strategy of decrypting taking advantage of VirLock's flaw.

2cDecrypt taking advantage of VirLock's exploit

Complexity (out of $10$)

Enter $64$ zeros in the decryption key field

Click in every file of the computer

(depends since it is more time consuming than complex)

grow to left by = - 0.25 cm,
grow to right by = - 0.25 cm,
colback = gray!03,
enhanced jigsaw,

sharp corners,
boxrule = 0.1 pt,
toprule = 0.1 pt,
bottomrule = 0.1 pt
The recovery strategy of using shadow volume copies.

2cRecover using shadow volume copies

Complexity (out of $10$)

Have shadow volume copies enabled and available beforehand

Boot into the Windows OS in safe mode

Recover to a previous shadow copy

grow to left by = - 0.25 cm,
grow to right by = - 0.25 cm,
colback = gray!03,
enhanced jigsaw,

sharp corners,
boxrule = 0.1 pt,
toprule = 0.1 pt,
bottomrule = 0.1 pt
The recovery strategy of using simple malware removal with antivirus.

2cMalware removal with antivirus

Complexity (out of $10$)

Boot into the Windows OS in safe mode

Install an antivirus using an external device

4 (not always necessary)

Scan the device for malware

grow to left by = 0.25 cm,
grow to right by = 0.25 cm,
colback = gray!03,
enhanced jigsaw,

sharp corners,
boxrule = 0.1 pt,
toprule = 0.1 pt,
bottomrule = 0.1 pt
The recovery strategy of using virus removal & cleaner with recovery features (antivirus + cleaner).

2cRecover using antivirus + cleaner

Complexity (out of $10$)

Boot into the Windows OS in safe mode

Install an antivirus using an external device

4 (not always necessary)

Install a VirLock cleaner using an external device

4 (not always necessary)

Run the cleaner (requires several steps and might result in deleting files that are not infected

Scan the device for malware

We rated the above steps based on how difficult it would be for a typical computer user to carry out one of these operations. The complexity variable has a scale from $0$ to $10$. $0$ meaning that any average user could complete this task without any issues, whereas $10$ means that the steps are either time consuming, dangerous, too complex (requiring special knowledge and have sub-steps) or there are factors that have other requirements. Depending on the relative success rate of a certain technique and the percentage of recovered files (in the event that the recovery of all of them is not possible), the effectiveness variable can have one of three possible values: low, medium, or high. When employing a specific recovery method, the user might be susceptible to contracting the virus once more. To quantify the risk in such an eventuality, the re-infection variable can be used as an indicator of whether the user is more or less susceptible to re-infection and uses the same scale as the effectiveness variable.

The previous tables (as well as the ransom payment payoff matrix of Figure <ref>) strive to assist the unlucky users that VirLock managed to infect their computer in order to choose a strategy that may offer them the highest pay-off against VirLock in their unique infection scenario. Additionally, individuals that have been infected by similar software may find the tables informative. The user can clearly benefit from having a well-thought-out plan in place beforehand (like those tables and game theory, in general, can provide). As aforementioned this can also help to analyze costs and benefits.

The recovery technique utilizing shadow volume copies has indeed a high success rate. However, whether it is possible at all or not, depends on how proactive the user is in terms of keeping shadow volume copies beforehand and how old they are. Moreover, depending on how many files the user stores in the computer, the “click on every file in your computer” step may not be a great option, but also it might not be needed at all depending on the situation. We point out that installation of an antivirus or antimalware software is not always necessary after the infection has taken place if they have been already installed beforehand and are still operational. The strategies above are broken into steps, and the difficulty value associated to each step is chosen with the average computer user in mind. Of course these values are subject to change based on the traits of the individual computer user. We should disclaim that, obviously, a computer science graduate or a high prestige company employee would make the complexity variable have much lower values, but this is not always the case.

§ MATHEMATICAL FORMULATION

§.§ Intuition and derivation

By taking into account all the aforementioned facts and measurements and by adding to the picture real-life factors, like the common behavior of a user during a computer virus infection scenario, as well as known factual data, we end up with conceptual mathematical equations and formulas. The underlying mathematical formulation not only supports procedures like the simple calculation of the severity of a virus, but can also help us factor out the importance of those realistic factors.

A great example that is conceptually close is set by the Common Vulnerability Scoring System (CVSS) which is a free and open industry standard, that identifies the key technical aspects of software, hardware, and firmware vulnerabilities. It generates numerical scores that indicate the severity of a vulnerability in comparison to other vulnerabilities. The scores are based on realistic characteristics of viruses and vulnerabilities, like the scope of the vulnerability, the user interaction, the availability, the level of possible remediation and many more. All the above metrics take similar values to the ones we used in the tables previously introduced. Finally, utilizing all the above, CVSS uses special formulas (like those we will present later on) to calculate a severity score that ranges from 0 to 10, with 10 being the critical severity level. Further info about CVSS can be found in this specification document <cit.>, and a CVSS calculator is also provided in <cit.>. Even though CVSS ratings for the severity levels are approximate, the system allows “players” to prepare more and get the necessary resources (for example a cloud access security broker or an antivirus) to achieve maximum payoff against the known threats <cit.>.

The existence of precise mathematical formulas enables further tests and experiments that may lead us to a definitive conclusion regarding the importance of the realistic factors during the infection (apart from the importance of the technical and technological ones). Games that make use of game theory could be created using these formulas in order to simulate certain infection scenarios. Then, by observing the players and the outcomes of the employed strategies, new strategies may be devised that are sure to offer advantages over the other existing ones (if any). We would like to create formulas that take into account the different types of end users and are specific for certain scenarios, so they can be more accurate than formulas utilizing the one size fits all approach. Again, in the field of biological viruses, there are several cases where formulas that factor realistic data are being used. An obvious case that comes to mind is the recent Covid-19 virus pandemic out-brake, where certain equations have been proposed <cit.>, <cit.>. Nonetheless, it would seem that such formulas (that constitute a precaution measure) are not being used widely in the field of computer virus attacks.

At this point, taking into account some of the factors that are extensively mentioned in the literature, and which can affect the behavior and the outcome of a possible infection, formulas that fit certain scenarios can be designed. The following example is based on a hypothetical ransomware attack (identical or similar to VirLock). For demonstration purposes we could also correlate a small city and its population getting infected by a biological virus to a computer network getting infected by a computer virus. Inspired from the CVSS and other formulas from the computer and the biological world, as well as the typical model of a commercial company, user profile and their characteristic behavior, we propose a group of novel formulas, which, combined with the standard game theory mechanics, we believe they can prove useful in the continuous endeavor to discover better strategies to cope with viral infection. Below we list the factors we have deemed particularly important to be taken into account in well-thought-out formulas of practical value, based on a VirLock, or an even more general, ransomware attack.

grow to left by = 0.00 cm,
grow to right by = 0.00 cm,
colback = RedPurple!03,
enhanced jigsaw,

sharp corners,

toprule = 1.0 pt,
bottomrule = 1.0 pt,
leftrule = 0.1 pt,
rightrule = 0.1 pt,
sharp corners,
center title,
fonttitle = ]

* $A$ : User’s awareness of the computer virus / User's computer literacy-knowledge / Sudden anxiety from the attack

* $B$ : Economical state of the user / company

* $C$ : Criticality of the encrypted data / Amount of the critical encrypted data

* $D$ : Amount of data

* $E$ : Amount of data the virus infects

* $F$ : Percentage of infected computers in the network

* $G$ : Known ways of effective disinfection / Possible ways of data recovery

* $H$ : The effectiveness of the known disinfection strategies all together (Percentage based on users that attempted the strategies)

* $I$ : Safety of operations during/after the infection

The following formula is used to estimate the spreadability score, denoted by $SPS$:

\begin{align} \label{eq:Spreadability Score}
SPS = 0.7 (100 - A) + 0.3 F
\ .
\end{align}

Given the spreadability score, the severity of the infection, denoted by $S$, can be computed by the next formula, in which parameter $G$ is assumed to be $> 0$.

\begin{align} \label{eq:Severity}
S = 0.1 C + 0.25 E + 0.1 F + 0.25 \, SPS + 0.3 G
\end{align}

In an analogous manner, the disinfection probability $DP$ is given by

\begin{align} \label{eq:Disinfection Probability}
DP = 0.15 A + 0.2 B + 0.1 (100 - E) + 0.15 (100 - F) + 0.3 H + 0.1 I
\ .
\end{align}

Finally, the disinfection payoff, denoted by $DC$, can be computed by the Algorithm <ref>, given below.

Disinfection payoff

$( C \leq 0.2 \ \mathrm{OR} \ S < 0.2 )$

$DC = 0$

$(C > 0.8)$

$DC = C$

$(S \leq 0.8)$

$DC = C * S$

$(S \leq 1)$

$DC = C$

$100 * DC$

The above formulas almost always return a decimal number which represents the corresponding score in the scale of $1 - 100$ (percentage). The values of the variables range from $1$ to $100$ and determine the final output probability. For example, if only $1/4$ of the computers in the network got infected the value of the $F$ variable would be $25$. If the encrypted data a company or an individual have are of an extreme critical importance and loss would mean huge drawbacks, then high criticality could range from $90$ to $100$ for the variable $C$. Having a certain percentage scale would help having more accurate numbers in pay-off matrices making sure that there's a certain amount of benefits both players can use in their advantage. Of course the above have certain flaws and are made up just for demonstration.

§.§ Test case scenario

To get a better understanding of previous mathematical concepts, we may visualize them with the following graphical representations. At the same time, this will allow us to compile a general profile of the players, which in this scenario are $2$ companies with different traits against VirLock.

grow to left by = - 2.00 cm,
grow to right by = - 2.00 cm,
colback = gray!03,
enhanced jigsaw,

sharp corners,
boxrule = 0.1 pt,
toprule = 0.1 pt,
bottomrule = 0.1 pt
The values of the variables used to model the profiles of the fictional companies A and B used in the example scenarios that follow.

3cVariables and their values

Company A

Company B

A     20     90

B     25     60

C     25     90

D     100     100

E     80     10

F     90     15

G     25     25

H     60     60

I     15     75

grow to left by = - 0.00 cm,
grow to right by = - 0.00 cm,
colback = white,
enhanced jigsaw,

sharp corners,

toprule = 1.0 pt,
bottomrule = 1.0 pt,
leftrule = 0.1 pt,
rightrule = 0.1 pt,
sharp corners,
center title,
fonttitle = ]

Graphic representation of the outcome provided by the preceding formulas given the traits that constitute the profile of the $2$ different companies. Its clear that the company A faces a significantly more severe problem compared to company B since its traits as a player are less beneficial than A's. The spreadability also rises significantly in the case of company A since the employees are technologically illiterate and the initial spread makes their condition worse. Looking at the aformentioned formulas and the scenario bellow we can get a better understanding of the outcome in the graph. The calculations were made through a computer program written in C based on the mathematical concepts introduced above.

The above Figure <ref> shows the different results the formulas produced after inserting values based of $2$ different fictional companies, one that is technologically literate and one that isn't. Keep in mind that some factors matter less in this scenario with these formulas. In this case a ransomware attack like VirLock’s could be much more effective against them in comparison to a company that keeps their employees up to date on the on-going threats. That is because viruses like VirLock aim for this trait in their victims. When VirLock gets sent via email to the aforementioned employees pretending to be an important document that they should forward, they will probably not think twice before spreading the virus. This will affect the spreadability score of a virus, and, thus, the severity as well. Assuming that the amount of data and their criticality is basically the same in both companies and that both of them are getting attacked from the same virus, we can understand the advantages and disadvantages of those $2$ players against the virus.

In the case of the technologically illiterate company the variables $A, F$ and $I$ have great differences compared to the technologically literate one, since most of the employees wouldn’t be able to identify a candy wrapped scam email and probably forward it to the rest of the network, i.e., the $F$ variable assumes higher values. By the time they realize that an infection took place they wouldn’t have a thought-out strategy of disinfection and the risk of disinfecting operations during that time could have a worse effect. In contrast, a company with well trained and up to date employees would probably have less of a problem and would restrict the spread in their network much faster. The $F$ variable would be lower and variable $I$ higher, leading to a less severe attack as well as lower spreadability and generally a higher payoff for them. In addition to the above the technologically literate company probably has much more data that are of critical importance, but have a much better data to infected data ratio due to their proactive strategy against the attack. In addition to that, their economical state is superior to the other company. The technologically illiterate company has a much higher data to infected data ratio but their data may not be of such critical importance. In such a scenario one may modify the values of the $B, C, D$, and $E$ variables accordingly.

Additionally, we have run extensive experiments in which a single trait was fixed to a constant value. This approach has enabled us to evaluate how a certain variable corresponding to that trait  affects the remaining variables and to what extent. In the following figures, a variable is chosen to be constant while all the other variables take values from $0$ to $100$. Examining the charts can visually illustrate the effects of the traits. Further explanations are given in the corresponding captions of the figures.

grow to left by = - 0.00 cm,
grow to right by = - 0.00 cm,
colback = white,
enhanced jigsaw,

sharp corners,

toprule = 1.0 pt,
bottomrule = 1.0 pt,
leftrule = 0.1 pt,
rightrule = 0.1 pt,
sharp corners,
center title,
fonttitle = ]

This chart displays a graphic plot of the formulas in the case where variable $A$ is constant with value $20$, while the values of the rest of the variables range from $0$ to $100$.

grow to left by = - 0.00 cm,
grow to right by = - 0.00 cm,
colback = white,
enhanced jigsaw,

sharp corners,

toprule = 1.0 pt,
bottomrule = 1.0 pt,
leftrule = 0.1 pt,
rightrule = 0.1 pt,
sharp corners,
center title,
fonttitle = ]

This chart plots the formulas when the variable $A$ is constant with value $80$ while the values of the rest of the variables range from $0$ to $100$.

Figure <ref> makes it even more clear that the huge increase in the values of the severity output from the formulas depends heavily on the value of the variable $A$. The conclusion is, as expected, that a company or an individual that is technologically illiterate and not up to date to the virus “games” is not only more susceptible to infection, but also finds it harder to disinfect and not spread the virus (especially in the scenario of VirLock) which is also why the spreadability line is much higher than bellow. Note that the severity line is slightly higher but steeper and the disinfection probability is also higher. A simple comparison between Figure <ref> and Figure <ref> demonstrates that the disinfection payoff is the same in both cases, i.e., when $A = 20$ and when $A = 80$, since this formula doesn't make use of the variable $A$.

grow to left by = - 0.00 cm,
grow to right by = - 0.00 cm,
colback = white,
enhanced jigsaw,

sharp corners,

toprule = 1.0 pt,
bottomrule = 1.0 pt,
leftrule = 0.1 pt,
rightrule = 0.1 pt,
sharp corners,
center title,
fonttitle = ]

The above figure contains a graphic plot of the formulas in the case where variable $C$ is constant with value $10$ while the values from the rest of the variables range from $0$ to $100$.

grow to left by = - 0.00 cm,
grow to right by = - 0.00 cm,
colback = white,
enhanced jigsaw,

sharp corners,

toprule = 1.0 pt,
bottomrule = 1.0 pt,
leftrule = 0.1 pt,
rightrule = 0.1 pt,
sharp corners,
center title,
fonttitle = ]

Chart presenting the output of the formulas where the variable $C$ is constant with value $90$ while the values from the rest of the variables range from $0$ to $100$.

In both Figures <ref> and Figures <ref>, we may observe a cross shape between severity and disinfection payoff in both cases where $C = 10$ and $C = 90$ chart. The cross is obviously higher in the $C = 90$ chart since the criticality of the data is extremely high, something that makes the attack more severe. The main difference between the two charts is the disinfection payoff of employing any strategy to get the data back. The intuition behind this is that since the criticality of the data encrypted is that high, it is extremely important (with value proportionate to the criticality of the data) to employ any strategy to get them back. The exact opposite from the chart where $C = 10$ where the $DP = 0$ since its not worth it to employ anything with such a low level data criticality.

§ DISCUSSION AND CONCLUSIONS

This article broadens the outlook on a potential new perspective and offers a starting point for experimentation in the future. Through the correlation of certain computer viruses with similar biological ones we set ground for further research involving the game theoretic perspective. Studying the traits and their similarities, apart from better understanding their impact factor in a game, can also hint that remedies and disinfection mechanics that work well in the biological world could appear effective through the proper correlation to the computer world in certain cases.

Game theory is a tool that might prove useful in the background as behavioral analysis is more and more needed with most antimalware software constantly improving their analysis tools. Analyzing the behavior of viruses, as well as the host machines and the users actions', can lead to the formulation of more effective strategies against an opponent. Using game theory as a tool could help tackle never-seen-before threats assisting AI technology. Alternative strategies for dealing with biological and computer viruses can appear through study of the relationship between them using appropriate tools and methodology. These game theory tools and methods we discussed could also prove useful in enhancing penetration testing reports, and vise versa, since the results of the penetration testing could feed the values of variables used in games.

The topic of threat assessment is very important in practice when trying to tackle multiple scenarios, especially in environments where data is critical. Moreover, risk analysis, in the form attempted in the previous tables and charts by analyzing the disinfection steps, is equally important in order to select a strategy that will offer the ultimate payoff. There are factors that sometimes are not taken into account, even though they are important and could change the possible outcome of an attack. The specific users and their traits should be taken into account when picking a strategy in order to achieve the optimum outcome, since just picking the ultimate security doesn't factor costs like price, complexity, application etc.

As a future work we intend to experiment with lab tests on computer viruses' spread in medium and small-sized networks. In that respect, the introduction of new games and pay-off matrices, based on real life scenarios for a wider range of users will be instrumental. We believe that evolutionary game theory provides the appropriate tools for keeping better track of viruses' mutations and describing strategies for fending off infections. To this end, we plan to extend the current formulas and further evaluate their usefulness for disinfection, spreadability and severity. Hopefully, this will allow us to obtain even more objective and realistic measurements from the corresponding games regarding the severity of a computer virus of a certain type in certain scenarios, the probability of disinfection, as well as if some specific strategies are more effective for this type of virus. Furthermore we would like to verify whether processes like natural selection and its properties also apply to computer environments.

It's important to point out that such formulas and calculations require a significant amount of data from reputable sources and security experts, as well as systematic maintenance to keep them up to date. It is clear that our formulas are still in an early form and they cannot apply to every possible scenario just yet, but they are an important tool in a theoretically constructed game theoretic framework for evaluation and assessment of effective strategies, assisting further research. By compiling and analyzing a great amount of data from real networks, small and big, company and personal, secured or not, that suffered virus attacks the accuracy of the parameters and constants involved could be increased, while new factors and variables could appear that should be taken into account and are not yet. This in turn will provide the key to evolve the formulas so that they better reflect real-world situations.

Another avenue of possible future research could be the assessment of already known and used biological virus formulas that estimate corresponding viral factors as well as their spreadability and severity per population. Again, by correlating technology and biological data interesting results could appear (for example the population of a city could be correlated to a company’s computer network). The above can show us the importance of certain traits and help us think of better pay-offs in the pay-off matrices of appropriately constructed games.


# Geometrical theory of the shift current in presence of disorder and
interaction

Raffaele Resta<EMAIL_ADDRESS>CNR-IOM Istituto Officina dei Materiali,
Strada Costiera 11, 34149 Trieste, Italy  Donostia International Physics
Center, 20018 San Sebastián, Spain

(run through LaTeX on at 8:59)

###### Abstract

The electric field of light induces—in a non centrosymmetric insulator—a dc
current, quadratic in the field magnitude, and called “shift current”. When
addressed from a many-electron viewpoint, the shift current has a simple
explanation and a simple formulation as well, deeply rooted in quantum
geometry. The basic formula is then specialized to the independent-electron
case, first for a disordered system in a supercell formulation, and then for a
crystalline system. In the latter case the known shift-current formula is
retrieved in a very transparent way.

In materials lacking inversion symmetry an electric field at frequency
$\omega$ generates a dc current, quadratic in the field magnitude: the
phenomenon goes under the name of “shift current”; its theory is formulated
for a crystalline system of independent electrons, and is rooted in the
quantum geometry of Bloch electrons [1, 2, 3, 4, 5, 6, 7, 8]. The phenomenon
has also been observed in presence of strong disorder [9]. Its robustness has
been regarded as a manifestation of the geometrical nature of the shift
current beyond band-structure theory [10], but an actual geometrical
formulation for the general case is lacking so far. Such a theory is provided
here; its main entry is the many-body shift vector, a simple geometrical
entity closely related to macroscopic polarization. The present general theory
copes with interacting electrons and noncrystalline materials; in the
crystalline case the known formula is retrieved in a very transparent way.

The shift current has a perspicuous explanation when the solid as a whole is
regarded from a many-electron viewpoint: the light pumps the population of the
resonant excited states at a constant rate, proportional to $E^{2}(\omega)$.
The excited states have a different polarization from the ground state; the
induced currents—i.e. the time-derivative of the polarizations—are therefore
equal to the rate times the polarization differences; as shown in this work,
the latter have a simple quantum-geometrical expression. The shift current is
a second-order response, nonetheless—when addressed in this way—its
explanation does not require second-order perturbation theory.

In order to simplify the presentation, I assume a material where inversion
symmetry is absent, but which is symmetric by reflection in the $x$ and $y$
directions; I only address the most paradigmatic component of the quadratic
conductivity: $\sigma_{zzz}^{(2)}(0;\omega,-\omega)$. Therefore all the
relevant vectors (field, polarization, momenta, current…) are directed along
$z$ and scalar-like notations can be safely adopted; the shorthand notation

$\tilde{\sigma}(\omega)=\sigma_{zzz}^{(2)}(0;\omega,-\omega)$ (1)

is also adopted throughout. The linearly polarized time-dependent field is
$E(t)=E(\omega)({\rm e}^{-i\omega t}+{\rm e}^{-i\omega t})$ and the shift
current is [5, 7]:

$j=2\;\tilde{\sigma}(\omega)E^{2}(\omega).$ (2)

One considers a system of $N$ interacting electrons in a cubic box of volume
$L^{3}$, whose eigenstates obey Born-von-Kàrmàn periodic boundary conditions
(PBCs). It is expedient to adopt the family of many-body Hamiltonians
parametrized by $\kappa$:

$\hat{H}_{\kappa}=\frac{1}{2m}\sum_{i=1}^{N}\left({\bf p}_{i}+\hbar\kappa{\bf
e}_{z}\right)^{2}+\hat{V},$ (3)

where $\hat{V}$ includes the one-body potential and electron-electron
interaction, and ${\bf e}_{z}$ is the unit vector in the $z$-direction. The
$\kappa$-dependent eigenstates are normalized in the hypercube of volume
$L^{3N}$. The limit $N\rightarrow\infty$, $L\rightarrow\infty$, $N/L^{3}$
constant is understood.

According to the theory of semiclassical absorption, the population $\pi_{n}$
of the $n$-th excited state increases linearly in time in presence of an
electric field at the resonance frequency; the ground state is depopulated by
the same amount. If $P_{0}$ and $P_{n}$ are the macroscopic polarizations of
the many-body states $|\Psi_{0}\rangle$ and $|\Psi_{n}\rangle$, respectively,
then the induced polarization is

$P^{(\rm ind)}(t)=\sum_{n\neq 0}\pi_{n}(t)\Delta P_{0n}\qquad\Delta
P_{0n}=P_{n}-P_{0}.$ (4)

Elementary time-dependent perturbation theory yields [11]

$\pi_{n}(t)=\frac{2\pi
e^{2}}{\hbar^{2}}E^{2}(\omega)|\langle\Psi_{0}|\,\hat{z}\,|\Psi_{n}\rangle|^{2}\delta(\omega-\omega_{0n})\,t,$
(5)

where $\omega_{0n}=(E_{n}-E_{0})/\hbar$. and the matrix elements—within
PBCs—are

$\langle\Psi_{0}|\,\hat{z}\,|\Psi_{n}\rangle=i\frac{\langle\Psi_{0}|\,\sum_{i}p_{i}\,|\Psi_{n}\rangle}{m\omega_{0n}}.$
(6)

Given that $j=\dot{P}^{(\rm ind)}$, a steady current flows therefore through
the sample; from Eqs. (2), (4), and (5) one gets

$\tilde{\sigma}(\omega)=\frac{\pi
e^{2}}{\hbar^{2}}\sum_{n}|\langle\Psi_{0}|\,\hat{z}\,|\Psi_{n}\rangle|^{2}\Delta
P_{0n}\delta(\omega-\omega_{0n}).$ (7)

As usual when dealing with conductivities, the singular function becomes a
continuous function in the $L\rightarrow\infty$ limit [12].

The many-body theory of polarization exists in a few variants [13, 14]. The
present work is inspired by Ref. [15], where it is shown that the electronic
polarization of a many-body state $|\Psi_{n}\rangle$ can be written as

$P_{n}=-\frac{ie}{L^{3}}\langle\Psi_{n}|\partial_{\kappa}\Psi_{n}\rangle,$ (8)

augmented with a prescription for fixing the gauge. Eq. (8) is a Berry
connection: being gauge-dependent it cannot represent by itself any physical
quantity. Here instead I am addressing $\Delta P_{0n}$, and fixing the gauge
is much simpler: it is in fact known since the dawn of polarization theory in
the early 1990s that dealing with polarization differences is much easier than
dealing with polarization itself [16, 17].

I start defining the many-body shift vector as

$\displaystyle{\cal R}_{0n}(\kappa)$ $\displaystyle=$ $\displaystyle
i\langle\Psi_{n}|\partial_{\kappa}\Psi_{n}\rangle-i\langle\Psi_{0}|\partial_{\kappa}\Psi_{0}\rangle$
(9) $\displaystyle+$ $\displaystyle\partial_{\kappa}\mbox{Im ln
}\langle\Psi_{0}|\partial_{\kappa}\Psi_{n}\rangle:$

a manifestly gauge-invariant expression. If one abandons for a while PBCs,
assuming that $|\Psi_{n}\rangle$ and $|\Psi_{0}\rangle$ are instead
eigenfunctions of Eq. (3) within open boundary conditions, it is then easy to
show that ${\cal R}_{0n}(\kappa)$ equals (at any $\kappa$) the difference
between the expectation values of the position operator
$\hat{z}=\sum_{i}z_{i}$ on the two eigenstates. The diagonal elements of the
operator $\hat{z}$ are ill defined within PBCs [14], yet Eq. (9) carries
therein the same physical meaning (i.e the difference of two extensive
dipoles); for the sake of simplicity I set $\kappa=0$ in the following.

Suppose that the gauge has been fixed, and that the given state
$|\tilde{\Psi}_{n}\rangle$, when adopted in Eq. (8), yields the genuine
polarization $P_{n}$. Then the generic eigenstate is $|\Psi_{n}\rangle={\rm
e}^{i\phi_{n}(\kappa)}|\tilde{\Psi}_{n}\rangle$ and

$-\frac{ie}{L^{3}}\langle\Psi_{n}|\partial_{\kappa}\Psi_{n}\rangle=P_{n}+\frac{e}{L^{3}}\phi_{n}^{\prime}(\kappa).$
(10)

The spurious phase-dependent terms are canceled in ${\cal R}_{0n}$, such that
in any gauge

$\Delta P_{0n}=-\frac{e}{L^{3}}{\cal R}_{0n};$ (11)

choosimg the “right” gauge in $|\tilde{\Psi}_{n}\rangle$ was unimportant,
after all. By inserting Eq. (11) in Eq. (7) we finally obtain the compact
expression:

$\tilde{\sigma}(\omega)=-\frac{\pi
e^{3}}{\hbar^{2}L^{3}}\sum_{n}|\langle\Psi_{0}|\,\hat{z}\,|\Psi_{n}\rangle|^{2}{\cal
R}_{0n}\,\delta(\omega-\omega_{0n}),$ (12)

which is the major result of the present work.

From now on we consider a system of independent electrons. The ground state
$|\Psi_{0}\rangle$ s a Slater determinant of $N/2$ doubly-occupied periodic
orbitals $|u_{j}\rangle$ with energies $\epsilon_{j}$; the generic excited
state $|\Psi_{n}\rangle$ is a monoexcited determinant where the occupied state
$j$ is replaced by the unoccupied $j^{\prime}$ one; the transition frequency
$\omega_{0n}$ becomes then
$\omega_{jj^{\prime}}=(\epsilon_{j^{\prime}}-\epsilon_{j})/\hbar$. One thus
recasts Eq. (4) as

$P^{(\rm
ind)}(t)=\sum_{\epsilon_{j}<\mu}\sum_{\epsilon_{j^{\prime}}>\mu}\pi_{jj^{\prime}}(t)\Delta
P_{jj^{\prime}},$ (13)

where $\mu$ is the Fermi level, and

$\pi_{jj^{\prime}}(t)=\frac{2\pi e^{2}}{\hbar^{2}}E^{2}(\omega)|\langle
u_{j}|\,z\,|u_{j^{\prime}}\rangle|^{2}\delta(\omega-\omega_{jj^{\prime}})\,t,$
(14)

The many-body matrix element in Eq. (5) has been transformed—owing to the
Slater-Condon rules—into the matrix element of the corresponding one-body
operator, i.e.

$\langle u_{j}|\,z\,|u_{j^{\prime}}\rangle=i\frac{\langle
u_{j}|\,p\,|u_{j^{\prime}}\rangle}{m\omega_{jj^{\prime}}}.$ (15)

The Berry connection of a Slater determinant equals the sum of the Berry
connections of the orbitals [18], ergo (for spinless electrons)

$i\langle\Psi_{n}|\partial_{\kappa}\Psi_{n}\rangle-i\langle\Psi_{0}|\partial_{\kappa}\Psi_{0}\rangle=i\langle
u_{j^{\prime}}|\partial_{\kappa}u_{j^{\prime}}\rangle-i\langle
u_{j}|\partial_{\kappa}u_{j}\rangle.$ (16)

The shift vector becomes then

$R_{jj^{\prime}}=i\langle
u_{j^{\prime}}|\partial_{\kappa}u_{j^{\prime}}\rangle-i\langle
u_{j}|\partial_{\kappa}u_{j}\rangle+\partial_{\kappa}\mbox{Im ln }\langle
u_{j}|\partial_{\kappa}u_{j^{\prime}}\rangle.$ (17)

From the above results the independent-particle version of Eq. (12) is

$\tilde{\sigma}(\omega)=-\frac{\pi
e^{3}}{\hbar^{2}L^{3}}\sum_{\epsilon_{j}<\mu}\sum_{\epsilon_{j^{\prime}}>\mu}|\langle
u_{j}|\,z\,|u_{j^{\prime}}\rangle|^{2}R_{jj^{\prime}}\delta(\omega-\omega_{jj^{\prime}}).$
(18)

This formula could be implemented as such within DFT in a supercell framework,
to deal with a disordered (yet non inversion-symmetric) material, such as a
solid solution with chemical disorder. Any differentiable gauge can be
adopted, including the parallel-transport gauge, in which case only the third
term in the shift vector yields a nonvanishing contribution.

I switch from now on to a crystalline insulator. After the
$L\rightarrow\infty$ limit is taken the Bloch vector ${\bf k}$ becomes
continuous; the spectrum becomes continuous as well. The single-particle
orbitals are Bloch states $|\psi_{j{\bf k}}\rangle={\rm e}^{i{\bf k}\cdot{\bf
r}}|u_{j{\bf k}}\rangle$, normalized to one in the crystal cell. I start
addressing—with no loss of generality—the simple case where only two bands
contribute to the shift current. The relevant band energies are
$\hbar\omega_{0{\bf k}}$ and $\hbar\omega_{1{\bf k}}$; in the ground state the
lowest band is occupied and the highest band is empty.

Let us preliminarily consider the simple case where all the electrons in the
lowest band are promoted to the highest one. Polarization theory yields (for
spinless electrons) the polarization difference

$\displaystyle\Delta P$ $\displaystyle=$ $\displaystyle ie\int_{\rm
BZ}\frac{d{\bf k}}{(2\pi)^{3}}\langle u_{0{\bf k}}|\partial_{k_{z}}u_{0{\bf
k}}\rangle$ (19) $\displaystyle-$ $\displaystyle ie\int_{\rm BZ}\frac{d{\bf
k}}{(2\pi)^{3}}\langle u_{1{\bf k}}|\partial_{k_{z}}u_{1{\bf k}}\rangle,$

where BZ is the Brillouin zone. Being the difference of two Berry phases, Eq.
(19) is affected by the notorious “quantum” indeterminacy in each of them
[19]. The drawback is removed by making use of the band-structure shift vector

$\displaystyle R_{01}({\bf k})$ $\displaystyle=$ $\displaystyle i\langle
u_{1{\bf k}}|\partial_{k_{z}}u_{1{\bf k}}\rangle-i\langle u_{0{\bf
k}}|\partial_{k_{z}}u_{0{\bf k}}\rangle$ (20) $\displaystyle+$
$\displaystyle\partial_{{\bf k}}\mbox{Im ln }\langle u_{0{\bf
k}}|\partial_{k_{z}}u_{1{\bf k}}\rangle,$

in terms of which the polarization difference is rewritten as

$\Delta P=-e\int_{\rm BZ}\frac{d{\bf k}}{(2\pi)^{3}}R_{01}({\bf k}).$ (21)

The second line in Eq. (20) integrates to zero over the BZ, since the periodic
gauge is assumed. It may happen that the matrix element therein vanishes at
some points in the BZ, thus making its phase ill defined [5]. Arguably, this
would only happen in a zero-measure set, not spoiling the argument in the
three-dimensional case. The additional term has the virtue of making the
integrand $R_{01}({\bf k})$ gauge-invariant, ergo $\Delta P$ is no longer
affected by the quantum indeterminacy: Eq. (21) fixes the gauge in Eq. (19).

The fact that $\Delta P$ in Eq. (21) is the BZ-integral of a gauge-invariant
integrand is of overwhelming importance: $\Delta P$ becomes the ${\bf
k}$-resolved sum of individual contributions originating from vertical
interband transitions. The radiation selectively pumps only the resonant ones
and therefore:

$P^{(\rm ind)}(t)=-e\int_{\rm BZ}\frac{d{\bf k}}{(2\pi)^{3}}\pi_{01}({\bf
k},t)R_{01}({\bf k});$ (22) $\displaystyle\pi_{01}({\bf k},t)$
$\displaystyle=$ $\displaystyle\frac{2\pi
e^{2}}{\hbar^{2}}E^{2}(\omega)|\langle\psi_{0{\bf k}}|\,z\,|\psi_{1{\bf
k}}\rangle|^{2}$ (23) $\displaystyle\times$
$\displaystyle\delta(\omega-\omega_{1{\bf k}}+\omega_{0{\bf k}})\,t.$

By setting once more $\tilde{\sigma}(\omega)=\dot{P}^{(\rm ind)}/2$ one
retrieves in a very transparent way the standard shift-current formula for the
simple two-band case. By considering as constant the matrix element therein
one retrieves the approximation proposed in Ref. 5.

Eq. (22) is easily generalized beyond the two-band model by summing the
contributions of any pairs of bands whose states are resonating at frequency
$\omega$. If the band energies are $\epsilon_{j{\bf k}}$ and
$\omega_{jj^{\prime}{\bf k}}=(\epsilon_{j^{\prime}{\bf k}}-\epsilon_{j{\bf
k}})/\hbar$, one gets explicitly

$\tilde{\sigma}(\omega)=-\frac{\pi e^{3}}{\hbar^{2}}\sum_{\epsilon_{j{\bf
k}}<\mu}\sum_{\epsilon_{j^{\prime}{\bf k}}>\mu}\int_{\rm BZ}\frac{d{\bf
k}}{(2\pi)^{3}}|\langle\psi_{j{\bf k}}|\,z\,|\psi_{j^{\prime}{\bf
k}}\rangle|^{2}R_{jj^{\prime}}({\bf k})\delta(\omega-\omega_{jj^{\prime}{\bf
k}}).$ (24)

For practical computations the integral can be discretized in the standard
way, since the integrand is gauge invariant; any differentiable gauge can be
adopted. This is at variance with the Berry-phase integrals of polarization
theory, which instead require a peculiar discretization [19]. If—for a large
supercell—Eq. (24) is discretized with the $\Gamma$ point only, one retrieves
Eq. (18).

In conclusion, I have addressed the shift current beyond the customary band-
structure framework, where the standard formula was obtained by manipulating
the cumbersome expansions of second-order perturbation theory [1, 2, 3, 4, 5,
6, 7, 8]. A much simpler approach, adopted here, addresses the excited states
of the many-body system and their selective pumping by the radiation,
accounted for by straightforward first-order perturbation theory. Similarly to
the band-structure case, the main entry in the present formulation is
geometrical: the many-body shift vector. It is closely related to polarization
theory in its many-body flavor [13, 14, 15], and has a perspicuous physical
meaning. It measures in fact the difference between the (extensive) dipoles of
an excited state and of the ground state. The independent-electron expression
for the shift current, Eqs. (17) and (18), is implementable as such to deal
with disordered solids (where inversion symmetry is broken) in a supercell
framework, similarly in spirit to the ab-initio calculations of infrared
spectra [20]. Last but not least, the present theory—when specialized to a
crystalline system of independent electrons—leads to the well known formula in
a few lines.

I thank Ivo Souza for the many fruitful conversations we had about this topic.
Work supported by the Office of Naval Research (USA) Grant No.
N00014-20-1-2847.

## References

  * Belinicher  _et al._ [1982] M. V. Belinicher, E. L. Ivchenko, and B. I. Sturman, Kinetic theory of the displacement photovoltaic effect in piezoelectric, Zh. Eksp. Teor. Fiz 83, 649 (1982).
  * Sipe and Shkrebtii [2000] J. E. Sipe and A. I. Shkrebtii, Second-order optical response in semiconductors, Phys. Rev. B 61, 5337 (2000).
  * Young and Rappe [2012] S. M. Young and A. M. Rappe, First principles calculation of the shift current photovoltaic effect in ferroelectrics, Phys. Rev. Lett. 109, 116601 (2012).
  * Morimoto and Nagaosa [2016] T. Morimoto and N. Nagaosa, Topological nature of nonlinear optical effects in solids, Science Advances 2, e1501524 (2016).
  * Fregoso  _et al._ [2017] B. M. Fregoso, T. Morimoto, and J. E. Moore, Quantitative relationship between polarization differences and the zone-averaged shift photocurrent, Phys. Rev. B 96, 075421 (2017).
  * Cook  _et al._ [2017] A. M. Cook, B. M. Fregoso, F. de Juan, S. Coh, and J. E. Moore, Design principles for shift current photovoltaics, Nature Communications 8, 14176 (2017).
  * Ibañez Azpiroz  _et al._ [2018] J. Ibañez Azpiroz, S. S. Tsirkin, and I. Souza, Ab initio calculation of the shift photocurrent by wannier interpolation, Phys. Rev. B 97, 245143 (2018).
  * Dai and Rappe [2023] Z. Dai and A. M. Rappe, Recent progress in the theory of bulk photovoltaic effect, Chemical Physics Reviews 4, 011303 (2023).
  * Hatada et al. [2020] H. Hatada et al., Defect tolerant zero-bias topological photocurrent in a ferroelectric semiconductor, Proc. Natl. Acad. Sci. 117, 20411 (2020).
  * Nagaosa [2022] N. Nagaosa, Nonlinear optical responses in noncentrosymmetric quantum materials, Annals of Physics 447, 169146 (2022).
  * Ballentine [1998] L. E. Ballentine,  _Quantum Mechanics_ (World Scientific, 1998).
  * Resta [2022] R. Resta, Theory of longitudinal and transverse nonlinear dc conductivity, Phys. Rev. Res. 4, 033002 (2022).
  * Ortiz and Martin [1994] G. Ortiz and R. M. Martin, Macroscopic polarization as a geometric quantum phase: Many-body formulation, Phys. Rev. B 49, 14202 (1994).
  * Resta [1998] R. Resta, Quantum-mechanical position operator in extended systems, Phys. Rev. Lett. 80, 1800 (1998).
  * Resta [2021] R. Resta, From the dipole of a crystallite to the polarization of a crystal, The Journal of Chemical Physics 154, 050901 (2021).
  * Resta [1992] R. Resta, Theory of the electric polarization in crystals, Ferroelectrics 136, 51 (1992).
  * King-Smith and Vanderbilt [1993] R. D. King-Smith and D. Vanderbilt, Theory of polarization of crystalline solids, Phys. Rev. B 47, 1651 (1993).
  * Resta [2000] R. Resta, Manifestations of berry’s phase in molecules and condensed matter, Journal of Physics: Condensed Matter 12, R107 (2000).
  * Vanderbilt [2018] D. Vanderbilt,  _Berry Phases in Electronic Structure Theory_ (Cambridge University Press, 2018).
  * Tuckerman [2002] M. E. Tuckerman, Ab initio molecular dynamics: basic concepts, current trends and novel applications, Journal of Physics: Condensed Matter 14, R1297 (2002).