Patent ID: 8015609
Filing Date: 2011-09-06
Classification: H04L

Abstract:
1. A detection device for detecting that a device in which a program is executed is infected with a worm, comprising: a route storage unit to store a processing route in which the program is correctly executed, the processing route being a path of a process flow when the program is executed correctly in the device connected to a network, by which the program is executed; a route recording unit to record an actual processing route in the device connected to the network, by which the program is executed while the program is actually being executed; a worm infection determining unit to determine whether the device is infected with a worm, by determining whether the route recorded by the route recording unit, when the program is actually being executed, coincides with the route stored in the route storage unit when the program not infected by a worm is executed; and an abnormal route storage unit to store a processing route when a device is infected with a worm, wherein the worm infection determining unit determines that the device is infected with a worm when a route recorded in the route recording unit coincides with a route stored in the abnormal route storage unit.