Implementation of Infection Environment for White-hat Worm and Malicious Botnet Using Mirai Source Code

In this paper, we create an infection environment for white-hat worms and a malicious botnet using Mirai source code. The environment also allowed us to observe the infectious capacity of the white-hat worm, focusing on the secondary infectious capacity. Secondary infectious capacity is necessary for the white-hat worm to get rid of the malicious botnet. To achieve this, this paper makes the following changes to the Mirai source code. Leaving an infected port open, making the process run in the background, and changing the function's compile options. We also added the concept of lifespan to the Mirai source code. And by creating secondary infectious capacity and life span we have created white-hat worms and malicious worms from the Mirai source code. Observations of the created environment revealed the following infections: (1) the case of only malicious botnet; (2) the case of only white-hat worm; (3) the case of a malicious botnet and white-hat worms. The results show that we should ensure a certain amount of infection time for white-hat worms. Under the conditions of this experiment, it was found necessary to set a lifetime of 180 seconds or longer, and to set a minimum of 100 units as the number of units to be searched at one time.