principles of traffic analysis

know the baseline
normal traffic patterns

when a host is compromised by a worm, it changes
actively tries to spread

therefore, detect deviations from normalcy
detect and analyze ...