Modern worm viruses not only tend to promote host attacks, but generate high volumes of traffic and frequently result in network failure. This paper proposes a learning-based algorithm for detecting abnormal traffic, ensuring efficient protection against worm viruses, and promoting network level security. The algorithm identifies abnormal traffic, and learns network level characteristics of this traffic, to prevent in advance factors that may result in network failure. The algorithm presented in this paper was applied to the network system, and simulation results showed that unlike previous network systems, the proposed algorithm more efficiency detects worm viruses, and overall, results in improved network security.