Systems that secure networks against malicious code will be a part of critical Internet infrastructure in the future. This article presents the design and implementation of a system that automatically detects new worms in real time by monitoring all traffic on a network. The system uses field-programmable gate arrays (FPGAs) to scan packets for patterns of similar content and can automatically detect the outbreak of a new Internet worm. It instantly reports frequently occurring strings in packet payloads as likely signatures of the malicious software (malware).