“…They compromise systems, steal sensitive information, congest network and launch many kinds of attacks. A worm's life consists of following phases [8,12]: (i) target finding, worm uses scanning technologies to search vulnerable hosts that can be compromised easily, (ii) transferring, worm sends its duplication to victims after the victims are discovered, (iii) activation, malicious activities of worms can be triggered based on a specific data or under a certain condition, (iv) infection, once worm has successfully infected the host, the infected host will exhibit malicious behaviors. During the first two phases, the worm is active over the Internet and causes some network anomalies, making it possible to be detected by exploiting its special behaviors.…”