Abstract: Worms have been one of the most serious threats to Internet security due to the significant damage,large range of victims and fast spread．How to detect network worm attack is an important aspect of network security research area．This article proposed a method which detects worms by analyzing and studying typical network behaviors while worms burst out．The algorithm studies the network behaviors of normal and abnormal computer separately,establishes standard fuzzy subsets of classification,and judges if the observation computer infects worms by utilizing fuzzy pattern recognition method．Finally,the experiment with the worm applications in the real world proves that this method is able to detect unknown scanning worms preferably.

Key words: Worm,Detection,Fuzzy pattern recognition,Network behavior