## 5 Conclusions  
In this paper, we propose an implementation system that uses a malicious worm created by modifying the Mirai source code and a white-hat worm. Using the publicly available Mirai source code, the study implemented the basic features of the white-hat worm, such as \"secondary infection\", in which the malicious worm is disinfected by infecting a device already infected by the malicious worm, and \"lifespan\", in which the worm terminates its own operation after a certain amount of time has passed after infecting a device. This paper shows how to implement a white-hat worm in general and specific ways that are not limited to the Mirai source code.  
Through experiments, we showed that the white-hat worm can eliminate the malicious botnet by optimizing two parameters of the white-hat worm, namely, the number of searches per attempt \(n\) and the lifespan \(\ell\), respectively, and demonstrated the effectiveness of the white-hat worm's function of eliminating the malicious botnet, which is to eliminate the malicious botnet. The effectiveness of the feature was demonstrated. A detailed analysis of each of the parameters of the white-hat worm revealed that the larger the value of \(n\), the more likely the white-hat worm is to infect multiple devices, and the larger the value of \(\ell\), the more likely it is to keep many devices infected with the white-hat worm, thus preventing the malicious botnet from spreading. This means that it is easier to keep a large number of devices infected with the white-hat worm and to prevent the malicious botnet from spreading and to disinfect the malicious botnet.  
The future work is to dynamically modify the parameters of the white-hat worm to eliminate malicious botnets with a minimum number of white-hat worms, focusing on efficiency and the ability to optimize the elimination of malicious botnets according to different situations of the malicious botnet. While white-hat worms have the benign property of disinfecting malicious botnets, the impact of communication generated by white-hat worms on the network increases with the number of devices infected by the white-hat worms, and especially in the case of large networks, this may have an impact on the performance and stability of the network. We have not yet conducted any research or simulations to evaluate the impact of white-hat worms on the overall performance and stability of a network. Determining the impact of white-hat worms on a network is one of the future studies to be conducted.  
In addition, to apply the proposed method to a network of about 1000 devices, we are working on implementing the distributed virtual machine environment by using multiple physical machines. For very large networks with more than 1000 (e.g., 10,000) devices, we are planning to address this issue in terms of both implemented systems and simulations.  
Conceptualization, Y.Y., A.F. and S.Y.; methodology, Y.Y., A.F. and S.Y.; software, Y.Y. and A.F.; validation, Y.Y.; formal analysis, Y.Y.; investigation, Y.Y.; resources, Y.Y., data curation, A.F.; writing--original draft preparation, Y.Y.; writing--review and editing, S.Y.; visualization, Y.Y.; supervision, S.Y.; project administration, S.Y.; funding acquisition, S.Y. All authors have read and agreed to the published version of the manuscript.  
This research was funded by JSPS KAKENHI, Grant Number JP22K12028.  
The source code of the malicious worm and white-hat worm based on the Mirai source code used in the implementation system proposed in this paper is available at [[https://github.com/aoao4](https://github.com/aoao4) riri/mirai]([https://github.com/aoao4](https://github.com/aoao4) riri/mirai) (accessed on 14 August 2024).  
The authors declare no conflicts of interest.  
The following abbreviations are used in this manuscript:  
C&C Command and Control ISP Internet Service Provider IDS Intrusion Detection System