A NetFlow based internet-worm detecting system in large network

The Internet worm infects the computer system, network packet, communication performance, and the traditional method of managing network using SNMP to monitor abnormal network traffic. To monitor suspicious Internet activity and to recognise the Internet worm categories, we proposed FloWorM system that can reduce the misjudgment and detection rate based on NetFlow which analyse the source data from the router. Our experiment and data testing are based on two companies.