From Research perspective your question has very limited use as mentioned by Jeff. What i understand from your question need to know the application of network based anomaly algorithms for detecting malicious network activity within your network. In short in research different algorithms has been proposed to catch network heuristics for specific malware activity. Few of them are

 1. TRW-CB (Threshold Random Walk with Credit Based Rate Limiting): The anomaly is observed on the observation that number of networks connections made by the benign node is far less as compared to malicious node within the network. 
 2. Maximum Entropy Detector : In this algorithms network traffic is modeled into different classes for benign entropy estimation and then divergence of new incoming packets will reveal anomaly depending on the threshold set by network administrator.
 3. Netad A rule based network anomaly algorithm. It calculates a packet score
depending on the time and frequency of each byte within the packet. Rare and novel
header values are assigned high scores. A threshold is applied on a packets score
to find anomalous packets. [source [Revisiting Traffic Anomaly Detection using
Software Defined Networking\]][1]

 

 


  [1]: http://wisnet.seecs.nust.edu.pk/publications/2011/raid2011_paper.pdf