An Internet Protocol (IP) usage pattern of a first computer system is monitored by a second computer system remotely located from the first computer system. Based on the monitoring, it is determined if the IP usage pattern is abnormal for the first computer system. If the IP usage pattern is abnormal, an alert signal is generated for the first computer system by the second computer system. The alert message indicates a potential presence of parasite software on the first computer system.