Worm, Address Resolution Protocol (ARP) broadcast and other abnormal behaviorS which attack the cloud computing platform from the virtual machines cannot be detected by traditional network security components. In order to solve the problem, abnormal behavior detection technology architecture for cloud computing platform was designed, abnormal behavior detection for worms which brought signature and non-signature behaviors based on mutation theory and "Detection-Isolation-Cure-Restore" intelligent processing for cloud security was proposed. Abnormal detection, management of event and defense, and ARP broadcast detection for cloud computing platform were merged in the system. The experimental results show that the abnormal behavior inside the cloud computing platform can be detected and defensed with the system, the collection and analysis of the abnormal behavior inside cloud computing platform can be provided by this system in real-time, the traffic information can be refreshed automatically every 5 seconds, the system throughput can reach to 640 Gb and the bandwith occupied by abnormal flow can be reduced to less than 5% of the total bandwith in protected link.