On 2 November 1988, Robert Tappan Morris released a program onto the early internet that exploited bugs in fingerd and sendmail plus weak passwords to copy itself onto other VAX and Sun hosts. It became the first worm to spread widely across a real production network and effectively founded the field of incident response.
This 2D counterpart runs the identical discrete-time epidemic model as the 3D version, on a flat small-world graph of N hosts laid out with a golden-angle spiral instead of a sphere — the graph topology, tick logic and formulas below are unchanged, only the layout dimension differs. Each host connects to its nearest neighbours plus a few long-range "shortcut" links (structurally similar to a 1988 university network of interconnected LANs). Every tick, for each edge (i, j) where i is infected and j is susceptible:
P(infect j this tick) = p_i (Bernoulli trial per edge)
An infected host is removed from the epidemic (patched/immune) with probability p_p per tick — modelling an administrator noticing and fixing the exploited services. The real 1988 worm carried a deliberate but badly-tuned defense against being shut down: before infecting a machine it was supposed to check whether a copy was already running there, but it skipped that check on a fraction of attempts (roughly 1-in-7) so that a determined system administrator couldn't kill it by faking the "already infected" signal. That flaw is reproduced here as the reinfection bug rate p_r: on every edge where j is already infected, a reinfection event fires with probability p_r, adding to that host's process/CPU load — which is exactly why the real worm crashed thousands of machines by resource exhaustion rather than any payload.
- Network size N — number of hosts in the graph (2D-only control, not present in the 3D version); rebuilds the topology and reseeds a single patient-zero host.
- pi — per-edge, per-tick chance the worm copies itself onto a reachable susceptible host.
- pp — per-tick chance an infected host gets patched and stops spreading.
- pr — per-tick, per-edge chance of a redundant reinfection landing on an already-infected host, driving up its visible pulse/load.
- Reseed — regenerates the network topology and restarts from a single patient-zero host.