Changwang ZHANG mleoking@163.com

0086 15581620524

Education

2011–2015 PhD in Security Science, University College London

Thesis: Hybrid epidemic spreading - from Internet worms to HIV infection

Supervisors: Dr Shi ZHOU and Prof Benjamin M. Chain

Funded by China Scholarship Council (CSC) Award and UCL Engineering Faculty Scholarship

Research Abstract:

Epidemic phenomena are ubiquitous, ranging from infectious diseases, computer viruses, to

information dissemination. Epidemics have traditionally been studied as a single spreading

process, either in a fully mixed population or on a network. Many epidemics, however, are

hybrid, employing more than one spreading mechanism. For example, the Internet worm

Conficker spreads locally targeting neighbouring computers in local networks as well as globally

by randomly probing any computer on the Internet. We aim to investigate fundamental questions,

such as whether a mix of spreading mechanisms gives hybrid epidemics any advantage, and what

are the implications for promoting or mitigating such epidemics. Based on theoretical analysis

and numerical simulations, we show that properties of hybrid epidemics are critically determined

by a hybrid tradeoff, which defines the proportion of resource allocated to local and global

spreading mechanisms. We then study two distinct examples of hybrid epidemics: the Internet

worm Conficker and the Human Immunodeficiency Virus (HIV) infection within the human

body. Using Internet measurement data, we reveal how Conficker combines ineffective spreading

mechanisms to produce a serious outbreak on the Internet. We propose a mathematical model that

can accurately recapitulate the entire HIV infection course as observed in clinical trials. Our study

provides novel insights into the two parallel infection channels of HIV, i.e. cell-free spreading

and cell-to-cell spreading, and their joint effect on HIV infection and treatment. In summary, our

study has advanced the understanding of hybrid epidemics. It has provided mathematical

frameworks for future analysis. It has demonstrated, with two successful case studies, that such

research can have a significant impact on important issues such as cyberspace security and human

health.

Research interests: Epidemic spreading phenomena; HIV infection dynamics and pathogenesis; Network security.

2010–2011 MRes in Security Science, University College London. [Distinction]

Thesis: Immunising the Internet

Supervisors: Dr Shi ZHOU and Prof Benjamin M. Chain

Funded by China Scholarship Council (CSC) Award and UCL Engineering Faculty Scholarship

2007–2009 MSc in Computer Science, National University of Defense Technology. [Outstanding]

Thesis: Active Queue Management Algorithms to Counter Denial-of-Service Attacks

Supervisors: Prof Jianping Yin

2003–2007 BS in Network Engineering, National University of Defense Technology

Publications

1

C. Zhang, S. Zhou, E. Groppelli, P. Pellegrino, I. Williams, P Borrow, B. M. Chain, C. Jolly, “Hybrid

spreading mechanisms and T cell activation shape the dynamics of HIV-1 infection”, PLoS Computational

Biology, 11(4):e1004179, 2015.

2 C. Zhang, S. Zhou, J. C. Miller, I. J. Cox, and B. M. Chain, “Optimizing Hybrid Spreading in

Metapopulations”, Scientific Reports, 5:9924, 2015.

3 C. Zhang, S. Zhou, and B. M. Chain, “Hybrid Epidemics - A Case Study on Computer Worm Conficker”,

PLoS ONE, 10(5): e0127478, 2015.

4 C. Zhang, Z. Cai, W. Chen, X. Luo, and J. Yin, “Flow level detection and filtering of low-rate DDoS,”

Computer Networks, 56(15):3417-3431, 2012. (Google Scholar citation count: 20)

5 C. Zhang, J. Yin, Z. Cai, and W. Chen, “RRED: robust RED algorithm to counter low-rate denial-of-service

attacks,” IEEE Communications Letters, 14(5): 489-491, 2010. (Google Scholar citation count: 50)

6 C. Zhang, S. Zhou, J. Li and B. M. Chain, “LeoTask: a productive and reliable framework for

computational research”, Bioinformatics. (under review)

Media Reports

My study has also attracted a considerable amount of media coverage, including reports from

The Guardian, Daily Mail, Times of India, Science Daily, International Business Times UK,

And 50 other news channels according to Google News.

Please find the details of the reports in the end.

Employment

Teaching Assistant for the following courses in University College London

2014 Software Engineering (COMPGC22), Supervise and organise weekly group meeting for 4 project

groups

2013 Systems Engineering Project 2 (COMP2014), Supervise & tutor lab sessions

2012 Programming 1 (INST1002), Supervise & tutor lab sessions

2012 Theory I (COMP1002), Give lectures on problem solving

2011 Operating systems (COMP3005), Supervise & tutor lab sessions and assess the course work

Skills S

Modelling of large scale epidemic spreading phenomena and numerical simulations

Parallel and multicore programming and performance tuning

Proficient in symbolic programming and Computer Algebra Systems (Mathematica, Maxima)

English writing

Website development

Media reports about Changwang Zhang’s research results

The Guardian: HIV spreads like computer worms, say scientists

http://www.theguardian.com/society/2015/apr/02/hiv-spreads-like-computer-worms-say-scientists

Daily Mail: HIV spreads like a computer worm: Researchers find virus mimics an online infection - and warn early detection is key

http://www.dailymail.co.uk/sciencetech/article-3023671/HIV-spreads-like-computer-virus-Researchers-spread-mimics-

online-infection-warn-early-detection-key.html

Times of India: HIV spreads like 'computer worms'

http://timesofindia.indiatimes.com/life-style/health-fitness/health-news/HIV-spreads-like-computer-worms/articleshow/

46803875.cms

India Today: HIV spreads like computer worms: Study

http://indiatoday.intoday.in/story/hiv-spreads-like-computer-worms/1/428233.html

International Business Times UK: HIV: Early treatment crucial as virus uses double entry mode

http://www.ibtimes.co.uk/hiv-early-treatment-crucial-virus-uses-double-entry-mode-1494842

Science Daily: HIV spreads like internet malware and should be treated earlier

http://www.sciencedaily.com/releases/2015/04/150402161747.htm

Guardian: HIV spreads like computer worms, say scientists

New model equates spread of worm across local networks and internet with progress of Aids virus through the body,

suggesting early treatment is vital

HIV spreads throughout the body in a similar way to some computer worms, according to a new model, which also

suggests that early treatment is key to finding a cure to the disease.

HIV specialists and network security experts at University College London (UCL) have found that HIV progresses

both via the bloodstream and directly between cells – akin to computer worms spreading themselves through two routes

to infect as many computers as possible.

Prof Benny Chain, from UCL’s infection and immunity division, the co-senior author of the research, said: “I was

involved in a study looking in general at spreading of worms across the internet and then I realised the parallel. They

have to consistently find another computer to infect outside. They can either look locally in their own networks, their

own computers, or you could remotely transmit out a worm to every computer on the internet. HIV also uses two ways

of spreading within the body.”

The model was inspired by similarities between HIV and computer worms such as the highly damaging “Conficker”

worm, first detected in 2008, which has infected military and police networks across Europe and is still active today.

The researchers’ findings, published on Thursday, told them that just as computer worms spread most efficiently by

a combination of two routes, so must HIV – enabling the researchers to create a model for this “hybrid spreading”,

which accurately predicted patients’ progression from HIV to Aids.

Detailed sample data from 17 HIV patients from London were used to verify the model, suggesting that hybrid

spreading provides the best explanation for HIV progression and highlighting the benefits of very prompt treatment.

Chain said the model provided strong evidence of cell-to-cell spread, which he said some HIV scientists remained

sceptical about, as it is difficult to observe in human beings because it occurs in tissue.

At present, the UK follows current World Health Organisation guidelines, which recommend only beginning

treatment for HIV when the infected person falls ill, or when the number of cells that protect their immune system fall

below a certain level, rather than as soon as someone tests positive. This approach reduces the amount of drugs taken

over a patient’s lifetime, while lessening the risk of – and delaying – the development of resistance.

But Chain said that it followed from UCL’s model that early intervention was required to completely block

cell-to-cell transfer as well as to prevent viral spread through the bloodstream.

He said: “Both of them [early and late intervention] work in terms of controlling the virus but there is a lot of

interest now in trying new jabs which will not only control your disease but cure it completely. It’s obviously not good

to be taking the drugs for the rest of your life.

“It’s much easier to eradicate the disease earlier than later. By the time it’s very well established there’s a lot more

of it eating away, so the idea of eradicating it becomes extremely difficult.”

The lead author of the research, Changwang Zhang, said both HIV and the Conficker worm “use hybrid spreading

mechanisms, persist for a very long time and are incredibly difficult to eradicate. Our model enables us to explain these

important properties and to predict the infection process.”

Daily Mail: Researchers find virus mimics an online infection - and warn early detection is key

A new model for HIV progression shows that it spreads in a similar way to some computer 'worms'.

HIV specialists and network security experts at University College London (UCL) made the discovery after creating

a simulation of how the virus spreads

They worked together to build a model for this 'hybrid spreading' which accurately predicted patients' progression

from HIV to AIDS in a major clinical trial - and say early treatment is key to staving off AIDS.

The teams noticed that the spread of HIV through the body using two methods - via the bloodstream and directly

between cells - was similar to how some computer worms spread through both the internet and local networks

respectively to infect as many computers as possible.

The model was inspired by similarities between HIV and computer worms such as the highly damaging 'Conficker'

worm, first detected in 2008, which has infected military and police computer networks across Europe and is still active

today.

Lead author Changwang Zhang, of UCL, said: 'HIV and Conficker have a lot in common.

'They both use hybrid spreading mechanisms, persist for a very long time and are incredibly difficult to eradicate.

'Our model enables us to explain these important properties and to predict the infection process.'

Changwang's supervisor co-author Dr Shi Zhou said: 'Although the cybersecurity community organised an

unprecedented collaboration to tackle Conficker, they still failed to eliminate Conficker from the Internet.

'HIV researchers face a similar problem. We hope that our new understanding of hybrid epidemics will help us to

fight against Conficker and HIV.'

Detailed sample data from 17 HIV patients from London were used to verify the model, showing that hybrid

spreading provides the best explanation for HIV progression and highlighting the benefits of early treatment.

HIV infects CD4+ T-cells, which play a vital role in the immune system and protect us from diseases. As HIV

progresses, it reduces the number of active T-cells in the body until the immune system cannot function correctly, a

state known as 'acquired immune deficiency syndrome' or AIDS.

Current World Health Organisation guidelines, which the UK government follows, recommend only beginning HIV

treatment when the number of T-cells in the bloodstream falls below a certain level.

However, the new model predicts that treatment should start as soon as possible after infection to prevent AIDS

from developing in the long term.

Co-senior author Professor Benny Chain, of UCL, said: 'The number of HIV cells in the bloodstream is always

relatively low, and our model shows that HIV spread through the bloodstream alone would not be enough to cause

AIDS.

'It is likely that when HIV gains a foothold somewhere with a high T-cell population, such as the gut, it uses a

cell-to-cell transfer mechanism to efficiently spread directly between them.

As such, if HIV has already spread to an area rich in T-cells by the time treatment begins, preventing its spread

through the bloodstream will not stop AIDS.

'Our model suggests that completely blocking cell-to-cell transfer would prevent progression to AIDS, highlighting

the need to develop new treatments.'

Laboratory research, led by co-senior author Dr Clare Jolly, has previously shown that some drugs are better than

others at stopping HIV from spreading directly between cells.

However, it's not possible to directly measure cell-to-cell spread in patients because it takes place inside internal

organs.

Dr Jolly said: 'With this new model, we should be able to assess the effectiveness of drugs against different modes

of HIV spread in real patients.

'This could prove invaluable when interpreting the results of drug trials to understand what works and why. Using

computer models to understand processes that we cannot directly observe is common in the physical sciences and

supports many fundamental theories.

'Our model provides strong evidence that cell-to-cell spread is an important part of HIV spread, and we hope to

show this directly in future animal studies.'.