Mirai and its many descendants spread the same way biological pathogens do: an infected device continuously scans random IP addresses looking for other IoT devices, and tries a short list of factory-default username/password pairs against anything that answers. This is exactly the classic epidemic SIS/SI process from mathematical epidemiology, applied to a network of N devices instead of a population of hosts:
dS/dt = -β·S·I/N - μ·S
dI/dt = β·S·I/N
dP/dt = μ·S
S = susceptible (weak/default credentials, unpatched)
I = infected (actively scanning + attacking)
P = patched/secured (credentials changed, firmware updated)
β = effective contact rate = scan_rate × P(default_credentials)
μ = patch/remediation rate
Each simulated tick, every infected device attempts scan_rate·dt random connections; a connection to a still-susceptible device succeeds with probability equal to the default-credential exposure slider, instantly recruiting it into the botnet (visualized as a red pulse beam and a color flip to red). Independently, susceptible devices get patched at rate μ as owners update firmware or change default passwords, permanently removing them from the vulnerable pool — this is the only force that can end the outbreak, since infected devices in this simplified model never self-recover (matching Mirai's real behavior: infection persists until reboot + credential change).
- Scan rate — how aggressively each bot probes for new victims (β component).
- Default-credential exposure — the fraction of scanned devices that still run factory passwords (the other β component; this is the number that manufacturers and regulators can actually move).
- Patch rate — how fast the population is inoculated; above a critical value the outbreak dies out before it can take over the network, exactly like herd immunity in a disease model.
Real-world relevance: this SI-with-removal model is the standard way security researchers estimate botnet growth curves (e.g. the original 2016 Mirai study measured β and the compromise plateau this way), and it's why "change the default password" moves the needle more than almost any other single IoT security control.