An information processing system including a first information processing apparatus configured to analyze behavior of malware started up and a second information processing apparatus configured to transfer transmission information transmitted thereto from the first information processing apparatus, wherein the first information processing apparatus comprises: a storage unit (34b, 35b) configured to store therein pieces of data which the malware has a possibility of making an attempt to reveal in information leakage, and pieces of tag information assigned to the pieces of data, so as to be kept in correspondence with one another; and a transmitting unit that, when the malware transmits data, is configured to generate the transmission information containing the transmitted data and the tag information assigned to the transmitted data and further transmit the generated transmission information to the second information processing apparatus, wherein, when transmitting the generated transmission information, the transmitting unit is configured to store the tag information assigned to the transmitted data into a section following a data section of a frame, wherein the frame has a size exceeding a predetermined maximum transmittable size, and the second information processing apparatus comprises: an extracting unit configured to, when the frame length of the received transmission information is over the maximum transmittable size, determine that the tag information is assigned to the received transmission information, and extract the tag information from the received transmission information; tag type information configured to keep each of the pieces of tag information in correspondence with a piece of information indicating whether or not a piece of data to which the piece of tag information is assigned is permitted to be transferred to an external apparatus via a real Internet network; and a transfer unit configured to determine a transfer destination of the transmission information, by selecting one from between a simulating Internet network and the real Internet network by referring to the tag type information, and to further transfer the transmission information to the determined transfer destination. a storage unit (34b, 35b) configured to store therein pieces of data which the malware has a possibility of making an attempt to reveal in information leakage, and pieces of tag information assigned to the pieces of data, so as to be kept in correspondence with one another; and a transmitting unit that, when the malware transmits data, is configured to generate the transmission information containing the transmitted data and the tag information assigned to the transmitted data and further transmit the generated transmission information to the second information processing apparatus, wherein, when transmitting the generated transmission information, the transmitting unit is configured to store the tag information assigned to the transmitted data into a section following a data section of a frame, wherein the frame has a size exceeding a predetermined maximum transmittable size, and an extracting unit configured to, when the frame length of the received transmission information is over the maximum transmittable size, determine that the tag information is assigned to the received transmission information, and extract the tag information from the received transmission information; tag type information configured to keep each of the pieces of tag information in correspondence with a piece of information indicating whether or not a piece of data to which the piece of tag information is assigned is permitted to be transferred to an external apparatus via a real Internet network; and a transfer unit configured to determine a transfer destination of the transmission information, by selecting one from between a simulating Internet network and the real Internet network by referring to the tag type information, and to further transfer the transmission information to the determined transfer destination.