Method and system for detection and prediction of computer virus-related epidemics

A method for generating a prognosis for malware epidemic, the method being performed on a computer having a processor and a memory, the method comprising:

• detecting an epidemic in a source geographic area;
• calculating connection strength coefficients between the source geographic area and other connected geographic areas;
• calculating a probability of the epidemic for each of the connected geographic areas based on the connection strength coefficients between the source geographic area and the connected geographic area;
• and
• calculating an activity level of the epidemic in each of the connected geographic areas for pre-set time increments,
• wherein the activity level is calculated based on malware parameters.

A system for detection of a malware-related epidemic, the system comprising:

• a processor and a memory in a computer configured to implement
• a malware detection system;
• a real-time processing database coupled to the malware detection system;
• a defense module;
• a white list database accessible by the malware detection system;
• an anti-virus (AV) record database coupled to the defense module and accessible by the malware detection system;
• and
• a deferred analyses database coupled to the real-time processing database,
• wherein:
• raw data, received from the defense module by the real-time processing database is compared against the white list database;
• the detection system receives the data from the real-time processing database and runs the data against the AV data base;
• the defense module determines if the data contains malware;
• and
• if the malware is detected, the defense module calculates an activity level for the malware;
• the defense module determines a source of the malware;
• the defense module determines if the malware causes an epidemic;
• and
• if the epidemic is detected, the defense module generates a prognosis for spread of the epidemic.