This paper introduces an abnormal scan behavior monitoring methods based on numerical analysis. It designs and develops a monitoring system with Netflow network management data, to achieve real-time monitoring for abnormal behaviors such as network worms, IRC Trojan zombie outbreak and spreading of malicious scan by hackers, etc. The system shows significant implement results, and increase network security support service capabilities of ISP.