In recent years,worms have gradually become serious security threats to Internet. However,the existing detection algorithms of worms are insufficient due to their high false detection rate. In order to solve this problem,a similarity-based detection algorithm of worms is proposed,which optimizes the basic cumulative abnormal detection algorithm by analyzing the similarity of abnormal data series to worm scanning characteristics,and dynamically
adapt the detection threshold to complex network environments using a Kalman filter. Simulated results indicate that,as compared with the basic cumulative abnormal detection algorithm,the proposed algorithm is more effective because it reduces the false detection rate and improves the detection accuracy.