1. A computer-implemented method comprising: detecting a download event in a client computer, the download event involving download of a file into the client computer; forwarding a download event information from the client computer to a malware download detection system, the download event information comprising a source uniform resource locator (URL) from which the file was downloaded by the client computer, an identifier of the client computer, and an identifier of the file; performing, by the malware download detection system, the steps of: updating a download graph using the download event information, training one or more classifiers using information from the download graph, consulting the one or more classifiers to concurrently classify the file and the source URL, classifying the download event as malicious if either the file or the source URL is classified as malicious, and providing the client computer a result of classifying the download event, wherein the download graph comprises a tripartite download graph, and wherein the download graph further comprises a set of nodes of source URLs, a set of nodes of client computers that provide download event information to the malware download detection system, and a set of nodes of files; and preventing execution of the file at the client computer upon receiving from the malware download detection system the result indicating the download event is malicious.