Patent ID: 7743419

Claim:
A method for detecting a malware epidemic, the method being performed on a computer having a processor and a memory, the method comprising: (a) detecting a malware-related threat; (b) calculating an activity value for this threat based on parameters of the threat; (c) setting a threshold value for the threat activity burst based on known bursts of the threat activity; (d) setting a threshold value for a threat activity epidemic based on the known epidemics; (e) comparing the threat activity value against the threat activity burst threshold; (f) comparing the threat activity value against the threat activity epidemic threshold, if the threat activity exceeds the threat activity burst threshold; (g) monitoring the threat activity over a selected time period, if the threat activity exceeds the activity epidemic threshold; and (e) detecting the malware epidemic, if the threat activity persistently exceeds the activity epidemic threshold over the pre-set time period.