A combining apparatus, comprising: an acquiring unit configured to acquire executed script codes included in a website in an order in which the script codes are executed, the script codes having been divided through a plurality of script tags written at plural locations in the website, according to execution time information recorded in script code execution history information; and a code combining unit configured to acquire definition information of a variable or function and reference information of the variable or function from data in each of the acquired script codes, and to combine together, based on the acquired information, a plurality of the acquired script codes having a variable or function in common in order to obtain a combined code, wherein the code combining unit is further configured to extract a script code that dynamically generates a new script code when executed, to extract a new script code generated by execution of the extracted script code, and to combine together the extracted script code and the extracted new script code in order to obtain a combined code; wherein the code combining unit is further configured to output a result of the combining to an analyzing function for analyzing the content and the script of the website in order to detect a malicious website, and then select, as a next code to be analyzed by the code combining unit, a code that has not been analyzed yet in sequence from the codes acquired by the acquiring unit; and wherein the combining apparatus further comprises the analyzing function configured to analyze the result of the combining output by the code combining unit in order to detect a malicious website. an acquiring unit configured to acquire executed script codes included in a website in an order in which the script codes are executed, the script codes having been divided through a plurality of script tags written at plural locations in the website, according to execution time information recorded in script code execution history information; and a code combining unit configured to acquire definition information of a variable or function and reference information of the variable or function from data in each of the acquired script codes, and to combine together, based on the acquired information, a plurality of the acquired script codes having a variable or function in common in order to obtain a combined code, wherein the code combining unit is further configured to extract a script code that dynamically generates a new script code when executed, to extract a new script code generated by execution of the extracted script code, and to combine together the extracted script code and the extracted new script code in order to obtain a combined code; wherein the code combining unit is further configured to output a result of the combining to an analyzing function for analyzing the content and the script of the website in order to detect a malicious website, and then select, as a next code to be analyzed by the code combining unit, a code that has not been analyzed yet in sequence from the codes acquired by the acquiring unit; and wherein the combining apparatus further comprises the analyzing function configured to analyze the result of the combining output by the code combining unit in order to detect a malicious website.