A method for detecting a malware epidemic, the method being performed on a computer having a processor and a memory (22, 24, 25, 27), the method comprising: (a) detecting a malware-related activity burst presenting a malware-related threat by determining connections between incoming data and subsequently launched files by a multidimensional database and detecting malware attributes associated with the incoming data and the subsequently launched files; (b) calculating an activity value for the malware-related threat as a function of activity parameters of the threat within a time period between two consecutive occurrences of an event related to at least one of the activity parameters; (c) setting a threshold value for a threat activity burst (L burst) based on known bursts of a threat activity; (d) setting a threshold value for a threat activity epidemic (L high) based on known malware epidemics; (e) comparing the threat activity value against the threat activity burst threshold (L burst); (f) comparing the threat activity value against the threat activity epidemic threshold (L high), if the threat activity exceeds the threat activity burst threshold (L burst); (g) monitoring the threat activity value over a selected time period, if the threat activity value exceeds the threat activity epidemic threshold (L high); (h) declaring a malware epidemic upon detecting that the threat activity value persistently exceeds the threat activity epidemic threshold (L high) over the selected time period; and (i) analyzing the connections between the incoming data and the subsequently launched files to calculate a source of the malware epidemic, if a malware epidemic is declared. (a) detecting a malware-related activity burst presenting a malware-related threat by determining connections between incoming data and subsequently launched files by a multidimensional database and detecting malware attributes associated with the incoming data and the subsequently launched files; (b) calculating an activity value for the malware-related threat as a function of activity parameters of the threat within a time period between two consecutive occurrences of an event related to at least one of the activity parameters; (c) setting a threshold value for a threat activity burst (L burst) based on known bursts of a threat activity; (d) setting a threshold value for a threat activity epidemic (L high) based on known malware epidemics; (e) comparing the threat activity value against the threat activity burst threshold (L burst); (f) comparing the threat activity value against the threat activity epidemic threshold (L high), if the threat activity exceeds the threat activity burst threshold (L burst); (g) monitoring the threat activity value over a selected time period, if the threat activity value exceeds the threat activity epidemic threshold (L high); (h) declaring a malware epidemic upon detecting that the threat activity value persistently exceeds the threat activity epidemic threshold (L high) over the selected time period; and (i) analyzing the connections between the incoming data and the subsequently launched files to calculate a source of the malware epidemic, if a malware epidemic is declared.