All alerts that have iv_alert.alertType = 13 are NTBA worm alerts.
The worm alert has anomaly measure data block, hosts block, and 3 sets of data blocks with base and observed values showing the deviation. The hosts block contains a list of host IDs which were involved in the worm attack. The observed and base data blocks are for bi-directional out connection and sent received ratios.
