vt-ng detects virus and worm like activity based
on communication patterns. It can be used to
detect infected hosts within your internal network
and stop the spread of malware. Detection is based
on the fact that malware usually tries to initiate
many connections to the outside network for
various reasons, such as to "phone home", download
further malware, or scan the network for other
vulnerable hosts.