Every node on the floor is a home IoT device — a camera, router or DVR. Yellow nodes still run factory-default or weak credentials; a worm (modeled on Mirai, the 2016 botnet that knocked major sites offline) continuously scans random IP ranges for open Telnet/SSH ports and tries a short list of default logins. A device that answers turns red — infected, now part of the botnet — and immediately starts scanning its own neighbours, so the infection spreads exponentially through the weak devices rather than needing a single attacker to reach every one directly. Firmware patching (blue) represents a vendor push or a user finally changing the password: it removes a device from the pool for good, whether it was still vulnerable or already infected.
P(infect | weak) = 1 − e^(−scanRate·dt)
P(patch) = 1 − e^(−patchRate·dt)
target_load = infected_bots / target_capacity
- Devices — size of the local IoT population being modeled.
- Weak / default credentials — the fraction of devices shipped or left with factory logins; this is the entire attack surface Mirai-class worms rely on.
- Worm scan rate — how aggressively the botnet probes for new victims; higher rate means faster exponential spread.
- Firmware patch rate — how quickly vendors/users harden or clean devices; this is the only lever that shrinks the botnet once it exists.
- Launch DDoS — every currently-infected device fires simulated traffic at the central target server; watch its load bar climb past capacity and flip the status flag to DOWN.
Real-world relevance: the original Mirai botnet infected hundreds of thousands of cameras and routers this same way — via unchanged default passwords — then used them to flood DNS provider Dyn, taking down Twitter, Netflix and other major sites for hours in October 2016.