Worm detection and response systems must act quickly to identify and quarantine scanning worms, as when left unchecked such worms have been able to infect the
majority of vulnerable hosts on the Internet in a matter of minutes [53]. Active worm spread in an automated fashion and can flood the internet in a very short time. The aim of this project is to improved algorithm to detect internet worm by two sub algorithm. The first is detecting the internet worm and the second is detecting stealth
internet worm. A new equation created for depending on the average failure connection. The study based on the comparison and analysis of many worm detection and containment strategies. The principle of this effective algorithm is an improved two rotation process to detect and contain all types of internet worms
