## 4 Experiments and Evaluations
### Evaluation  
Based on the results of the experiment, as shown in Figures 7 and 8, the values of two parameters of the white-hat worm, the number of scans per attempt \(n\), and the lifespan \(\ell\), respectively, were analyzed to determine how they affect the disinfection of the malicious botnet. First, we found that increasing the value of \(n\) makes the white-hat worm less susceptible to the effects of randomness and makes it more likely to infect multiple devices. Table 3 shows the parameters that allowed the white-hat worm to infect multiple devices. In Table 3, we checked for the parameters that allowed the white-hat worm to infect multiple devices. For \(n=50\), the white-hat worm spread only when \(\ell=180\), but for \(n=100\), the white-hat worm spread at \(\ell=180\) and \(\ell=300\), and for \(n=160\), the white-hat worm spread regardless of the value of \(\ell\). For \(n=50\), the white-hat worm spread only when \(\ell=180\)  
Figure 8: Experimental results of modifying each parameter of the white-hat worm using 30 vulnerable devices. \begin{table}
\begin{tabular}{c c c} \hline \hline  & \(\boldsymbol{\ell=60}\) & \(\boldsymbol{\ell=180}\) & \(\boldsymbol{\ell=300}\) \\ \hline \(n=50\) & & \(\checkmark\checkmark\) & \\ \hline \(n=100\) & & \(\checkmark\checkmark\) & \(\checkmark\checkmark\checkmark\) \\ \hline \(n=160\) & \(\checkmark\checkmark\) & \(\checkmark\checkmark\checkmark\) & \(\checkmark\checkmark\checkmark\) \\ \hline \hline \end{tabular}
\end{table} 
Table 3: Parameters that enabled the white-hat worm to infect multiple devices. The parameters that allowed the white-hat worm to infect multiple devices are checked. and \(\ell=300\), and the white-hat worm failed to spread the infection. This result indicates that for smaller values of \(n\), the worm is more susceptible to the effects of randomness in searching for vulnerable devices, making it more difficult to find vulnerable devices and spread infection, even if the time until the operation is terminated is set to be long by lifespan. Thus, the larger the value of \(n\), the smaller the impact of randomness in searching for vulnerable devices, indicating that the white-hat worm is more likely to spread infection to multiple devices. Increasing the value of \(\ell\) decreased the number of devices infected by the white-hat worm, making it easier to prevent the occurrence of a situation in which the malicious botnet is more likely to spread. Table 4 shows the parameters under which the white-hat worm was able to prevent the expansion of the malicious botnet. In Table 4, the parameters for which the white-hat worm was able to prevent the expansion of the malicious botnet are checked. For \(\ell=60\), the white-hat worm was unable to prevent the malicious botnet from spreading regardless of the value of \(n\); for \(\ell=180\), the white-hat worm was able to prevent the malicious botnet from spreading for \(n=50\) and \(n=100\); and for \(\ell=300\), the white-hat worm was able to prevent the malicious botnet from spreading for \(n=100\) and \(n=160\). Also, focusing on Figure 8e,f, the number of devices infected by the white-hat worm for \(\ell=180\) is below 25 most of the time, while for \(\ell=300\), it is above 25 most of the time. In other words, the higher the value of \(\ell\), the more devices are infected before the operation is terminated by the lifespan, indicating that the white-hat worm can maintain a situation where more devices are infected. Also from Figure 8g through Figure 8i, we can see that for \(n=160\), similarly, the larger the value of \(\ell\), the more devices were infected until the operation was terminated due to lifespan, and the white-hat worm was able to maintain the situation where more devices were infected. Thus, the longer the white-hat worm was able to infect more devices, the easier it was to disinfect the malicious botnet.