An identifying device comprising: a malware execution environment unit configured to execute malware to be analyzed on a guest OS; a monitoring unit configured to monitor the malware and acquire, as log data, the malware, download data downloaded from a communication destination, and a relation of data transfer performed with the malware or the communication destination of the download data; a creating unit configured to create, by using the log data acquired by the monitoring unit, a dependency relation graph that is a digraph in which the malware, the download data, and the communication destination are set as nodes and a dependency relation of each node is set as an edge; and an identifying unit configured to detect a malicious node by collating the respective nodes of the dependency relation graph created by the creating unit with known maliciousness information, to trace an edge between nodes having a data dependency relation from a terminal point which is the detected malicious node to a start point, to identify the start point as malicious on the ground of maliciousness of the terminal node, and to identify a traced node between the start point and the terminal point as a new malicious node, wherein the monitoring unit performs monitoring by assigning a tag to a file of the malware, and in the case where the malware calls an API to be monitored, the monitoring unit acquires the log data by assigning, to data related to the API, a tag that can uniquely identify a transmission source of the data and then tracking propagation of the data assigned with the tag, and wherein the monitoring unit further performs monitoring by acquiring a value of an instruction pointer register and determining if a memory region indicated by the instruction pointer register is assigned with a monitoring target tag, and the creating unit is configured to track a dependency relation between the download data and execution of program code based on the determining if the memory region is assigned with a monitoring target tag. a malware execution environment unit configured to execute malware to be analyzed on a guest OS; a monitoring unit configured to monitor the malware and acquire, as log data, the malware, download data downloaded from a communication destination, and a relation of data transfer performed with the malware or the communication destination of the download data; a creating unit configured to create, by using the log data acquired by the monitoring unit, a dependency relation graph that is a digraph in which the malware, the download data, and the communication destination are set as nodes and a dependency relation of each node is set as an edge; and an identifying unit configured to detect a malicious node by collating the respective nodes of the dependency relation graph created by the creating unit with known maliciousness information, to trace an edge between nodes having a data dependency relation from a terminal point which is the detected malicious node to a start point, to identify the start point as malicious on the ground of maliciousness of the terminal node, and to identify a traced node between the start point and the terminal point as a new malicious node, wherein the monitoring unit performs monitoring by assigning a tag to a file of the malware, and in the case where the malware calls an API to be monitored, the monitoring unit acquires the log data by assigning, to data related to the API, a tag that can uniquely identify a transmission source of the data and then tracking propagation of the data assigned with the tag, and wherein the monitoring unit further performs monitoring by acquiring a value of an instruction pointer register and determining if a memory region indicated by the instruction pointer register is assigned with a monitoring target tag, and the creating unit is configured to track a dependency relation between the download data and execution of program code based on the determining if the memory region is assigned with a monitoring target tag.