A suggested alternative is to use span pcap dumps of network environments that have viruses spreading through them (I used a few of them for a earlier project for worm detection), although I can't seem to find those website at the moment. But something to keep in mind. Try searching for Defcon packet dumps.

A added benefit would be replaying the same test environment repeatedly while tweaking your detectors parameters.