We implement the worm propagation model with three classes: WormApp, DnhWormApp, and AnWormAppns-2/apps/worm.{cc,h}. WormApp and DnhWormApp are used in the detailed network, representing invulnerable and vulnerable hosts respectively. AnWormApp is the abstract network. Currently, our model only supports UDP-based worms.
An vulnerable host is compromised upon receiving a probing packet. Then, it chooses a target host (randomly or with certain preference to local neighbors) to scan. Probing packets have no effect on invulnerable hosts. When the abstract network receives probing packets, it updates its current states.