## 3 Methodology
### Behavior of the Implementation System  
The behavior of each element of the proposed implementation system is shown in Figure 2. Figure 2 shows the behavior of the malicious worm infected with Device 1 when it spreads the infection to Device 2 and the white-hat worm infected with Device 3 when it spreads the infection to Device 1. The malicious worm and the white-hat worm use multiple components of the malicious botnet to spread infection. Those associated with the malicious botnet are shown in red and those associated with the white-hat botnet are shown in blue. The same applies in the figures that follow. The behavior of the implemented system can be divided into four categories: \"Discover (Figure 2a)\", \"Login (Figure 2b)\", \"Infect (Figure 2c)\" and \"Disinfect (Figure 2d)\". First, as shown in Figure 2a, the malicious worm and white-hat worm search for vulnerable devices and report information on the found device to the Scan Listener. In Figure 2a, it is assumed that a malicious worm infected by Device 1 discovers Device 2 and a white-hat worm infected by Device 3 discovers Device 1. Next, as shown in Figure 2b, the information that the Scan Listener receives from the worm about the vulnerable device is communicated to the Loader. The Loader then logs in to the vulnerable device after receiving the information about the vulnerable device. Next, as shown in Figure 2c, the Loader executes commands on the logged-in target device to download the worm from the web server that distributes the worm, and launches it. Finally, as shown in Figure 2d, the worms loaded by the Loader (the malicious worm loaded to Device 2 and the white-hat worm loaded to Device 1) become active. The white-hat worm loaded to Device 1 detects that the device is already infected by the malicious worm and removes the malicious worm. The sequence of malicious worms and white-hat worms infecting vulnerable devices is shown in Figure 3.  
Figure 2: _Cont._  
Although only 5 devices are included in Figure 3 due to limited space, there are actually more devices than this in the implemented system, as described below. Also, as indicated in green, there is a period of time during which both white-hat and malicious worms exist on the same device at the same time because of the time required for the white-hat worms to disinfect the malicious worms. For the malicious worm and white-hat worm to spread, each worm must infect at least one vulnerable device. Therefore, each malicious worm and white-hat worm is  
Figure 3: Sequence chart showing the behavior of malicious and white-hat worms. Figure 2: Behavior of malicious worms and white-hat worms in the implemented system. **(a)** The worm scans for vulnerable devices and reports the found device to the Scan Listener. **(b)** Upon receiving information about a vulnerable device from the Scan Listener, the Loader logs into that device. **(c)** The Loader logs into the vulnerable device and executes commands to download the worm to that device and then launch it. **(d)** Each worm put in by the Loader begins its activity, and the white-hat worm disinfects the malicious worm. manually infected one at a time on different devices. The flow of infection spread after this is described below, but since the infection targets are randomly determined, the behavior is not necessarily as shown in Figure 3.  
1. The malicious worm that manually infected Device 0 is registered on the malicious C&C server. 2. The white-hat worm that manually infected Device 4 is registered on the white-hat C&C server. 3. Device 2 is infected by the malicious worm that infected Device 0 (primary infection). 4. The malicious worm that infected Device 2 is registered on the malicious C&C server. 5. Device 3 is infected by the white-hat worm that infected Device 4 (primary infection). 6. The white-hat worm that infected Device 3 is registered on the white-hat C&C server. 7. The white-hat worm infecting Device 4 causes Device 2, which is already infected by the malicious worm, to be infected by the white-hat worm (secondary infection). 8.