An attacking node detection apparatus, being characterized by comprising: a storage unit, being stored with a plurality of access records (10a,..., 10b) of an application, wherein each of the access records (10a,..., 10b) comprises a network address of a host and an access content regarding the host accessing the application; and a processing unit, being electrically connected to the storage unit and configured to filter the access records (10a,..., 10b) into a plurality of filtered access records (12a,..., 12b) according to a predetermined rule, wherein the access content of each of the filtered access records (12a,..., 12b) conforms to the predetermined rule; wherein the processing unit further creates at least one access relation (R1, R2) for each of the network addresses according to the filtered access records (12a,..., 12b), each of the access relations (R1, R2) is defined by one of the network addresses (IP1, IP2) and one of the access contents, wherein the processing unit further identifies a specific network address among the network addresses as a first attacking node according to the access relations (R1, R2), wherein the processing unit further determines at least one node relation (R AB, R BC, R CA, R AC) for each of the network addresses (A, B, C) according to the access relations (R1, R2), each of the node relations (R AB, R BC, R CA, R AC) is defined by two of the network addresses (A, B, C), wherein the processing unit further assigns an initial score to the first attacking node, wherein the processing unit further propagates the initial score according to a propagation algorithm and the node relations (R AB, R BC, R CA, R AC) so that each of the network addresses (A, B, C) has a propagated score, and wherein the processing unit further selects at least one second attacking node among the network addresses, and the propagated score of each of the at least one second attacking node is greater than a predetermined threshold. a storage unit, being stored with a plurality of access records (10a,..., 10b) of an application, wherein each of the access records (10a,..., 10b) comprises a network address of a host and an access content regarding the host accessing the application; and a processing unit, being electrically connected to the storage unit and configured to filter the access records (10a,..., 10b) into a plurality of filtered access records (12a,..., 12b) according to a predetermined rule, wherein the access content of each of the filtered access records (12a,..., 12b) conforms to the predetermined rule; wherein the processing unit further creates at least one access relation (R1, R2) for each of the network addresses according to the filtered access records (12a,..., 12b), each of the access relations (R1, R2) is defined by one of the network addresses (IP1, IP2) and one of the access contents, wherein the processing unit further identifies a specific network address among the network addresses as a first attacking node according to the access relations (R1, R2), wherein the processing unit further determines at least one node relation (R AB, R BC, R CA, R AC) for each of the network addresses (A, B, C) according to the access relations (R1, R2), each of the node relations (R AB, R BC, R CA, R AC) is defined by two of the network addresses (A, B, C), wherein the processing unit further assigns an initial score to the first attacking node, wherein the processing unit further propagates the initial score according to a propagation algorithm and the node relations (R AB, R BC, R CA, R AC) so that each of the network addresses (A, B, C) has a propagated score, and wherein the processing unit further selects at least one second attacking node among the network addresses, and the propagated score of each of the at least one second attacking node is greater than a predetermined threshold.