Recently, many packet analysis methods are proposed for the threat of the increasing malware. In this research, the method for the analysis of the IP packet based on SOM(Self-Organizing Map) using the frequency of appearance of IP-packets as input vectors is proposed. The performance of this method is examined by the experiment of detecting the packets generated by emulating malware behaviors.