## 1 Introduction  
The IoT malware Mirai emerged in 2016 and has been used and affected by large-scale DDoS attacks, such as the DDoS attack on DNS provider Dyn in the same year, bringing down Twitter, Spotify, and other services [1]. The creator of Mirai claimed that up to 350,000 devices were connected to the Mirai botnet [2], and Reference [3] showed that at its peak, 600,000 devices were connected to the Mirai botnet. Mirai's source code was published on a hacker forum on 30 September 2016. Although this post has been removed, some Mirai source code is still available on GitHub [4, 5, 6]. This has made it easy to extend Mirai, and a number of variants have emerged. In particular, a variant called Meris, which appeared in 2021, is famous for generating larger-scale DDoS attacks than Mirai, and is also known as the \"re-emergence of Mirai\" [7]. In this paper, we implement a malicious worm and a white-hat worm by ethically using the publicly available Mirai source code. Mirai infects vulnerable IoT devices and forms botnets. The devices that make up the botnet launch DDoS attacks. In June 2024, Statisca predicted that there will be more than 39.6 billion IoT devices in use worldwide by 2033 [8]. This is about 2.5 times the 15.9 billion in 2023. As the number of IoT devices increases, the number of bot-enabled IoT devices will also increase, potentially leading to attacks on a larger scale than ever before, making dealing with malware that infects IoT devices an even more important issue. In this paper, we propose an implementation system using malicious and white-hat worms created using the Mirai source code, and we provide the implementation details and a detailed analysis of the parameters of the white-hat worm suitable for disinfectingmalicious botnets. Malicious worms, such as Mirai, infect vulnerable devices and form malicious botnets. White-hat worms, like malicious worms, infect vulnerable devices but have a \"secondary infection\" function that infects devices infected by a malicious worm in order to disinfect them, and a \"lifespan\" function that terminates its own activity after a certain amount of time. The created white-hat worm has two parameters whose values can be changed to modify the worm's propagation rate. In this paper, we provide details of the proposed implementation system and a detailed analysis of the parameters of the best white-hat worm for disinfecting malicious botnets. We clarify the impact of each of the two parameters of the white-hat worm on the disinfection of the malicious botnet, and we show the effectiveness of the white-hat worm's function in disinfecting the malicious botnet by tuning and optimizing the values of the white-hat worm's parameters. The major contributions of this paper are listed below. * We show a general and detailed implementation method for the functions of white-hat worms, such as \"secondary infection\", which is to infect a device already infected by a malicious worm to disinfect it, and \"lifespan\", which is to terminate its own operation after a certain amount of time has passed after infecting a device. Then, based on the method, we implemented a white-hat worm that works on a physical device using the publicly available Mirai source code. * Experiments with malicious worms and white-hat worms showed that a white-hat botnet can disinfect a malicious botnet by tuning and optimizing the respective values of two parameters of the white-hat worm, the number of vulnerable devices scanned per attempt, and the lifespan of the white-hat worm. We showed that the function of a white-hat botnet to disinfect a malicious botnet is feasible for practical use. In Section 2, we describe previous studies targeting the Mirai botnet and using the Mirai source code, as well as the BDS on which the idea of the white-hat worm is based. In Section 3, we describe the implementation system consisting of a malicious worm and a white-hat worm created using the proposed Mirai source code.