From Research perspective your question has very limited use as mentioned by Jeff. What i understand from your question you need to know the application of network based anomaly algorithms for detecting malicious network activity within your network. In short in research different algorithms has been proposed to catch network heuristics for specific malware activity. Few of them are
- TRW-CB (Threshold Random Walk with Credit Based Rate Limiting): The anomaly is observed on the observation that number of networks connections made by the benign node is far less as compared to malicious node within the network.
- Maximum Entropy Detector : In this algorithms network traffic is modeled into different classes for benign entropy estimation and then divergence of new incoming packets will reveal anomaly depending on the threshold set by network administrator.
- Netad A rule based network anomaly algorithm. It calculates a packet score depending on the time and frequency of each byte within the packet. Rare and novel header values are assigned high scores. A threshold is applied on a packets score to find anomalous packets. [source Revisiting Traffic Anomaly Detection using Software Defined Networking]