An information processing device arranged to specify a library function invoked to generate output data, the information processing device comprising: a library function execution monitoring unit arranged to, when analysis logs of a monitoring target program are generated, capture respective library functions invoked by the monitoring target program, and set, for each of the captured library functions, a tag for uniquely identifying the invocation of the library function, to the output data from the library function every time the library function is invoked; a log storage unit arranged to store the analysis log including the input data and the output data from the library functions; and a log searching unit arranged to search for logs stored in the log storage unit and specify a library function invoked to generate the output data which is obfuscation data from the information processing device by steps of: (i) referring to the logs accumulated in the log storage unit and finding a library function which has output the obfuscation data outside of the information processing device; (ii) referring to the logs accumulated in the log storage unit and obtaining a tag of the input data when data is input to the found library function and the tag is set to the input data; (iii) searching for the logs accumulated in the log storage unit, and specifying a library function which has generated data to which the obtained tag has been set; repeating steps (ii) and (iii) with respect to the library function specified in step (iii); and referring to the logs accumulated in the log storage unit and, when there is not data input to the library function found in step (i) and the tag is not set to the input data, specifying the library function as a function which has generated the obfuscation data. a library function execution monitoring unit arranged to, when analysis logs of a monitoring target program are generated, capture respective library functions invoked by the monitoring target program, and set, for each of the captured library functions, a tag for uniquely identifying the invocation of the library function, to the output data from the library function every time the library function is invoked; a log storage unit arranged to store the analysis log including the input data and the output data from the library functions; and a log searching unit arranged to search for logs stored in the log storage unit and specify a library function invoked to generate the output data which is obfuscation data from the information processing device by steps of: (i) referring to the logs accumulated in the log storage unit and finding a library function which has output the obfuscation data outside of the information processing device; (ii) referring to the logs accumulated in the log storage unit and obtaining a tag of the input data when data is input to the found library function and the tag is set to the input data; (iii) searching for the logs accumulated in the log storage unit, and specifying a library function which has generated data to which the obtained tag has been set; repeating steps (ii) and (iii) with respect to the library function specified in step (iii); and referring to the logs accumulated in the log storage unit and, when there is not data input to the library function found in step (i) and the tag is not set to the input data, specifying the library function as a function which has generated the obfuscation data. (i) referring to the logs accumulated in the log storage unit and finding a library function which has output the obfuscation data outside of the information processing device; (ii) referring to the logs accumulated in the log storage unit and obtaining a tag of the input data when data is input to the found library function and the tag is set to the input data; (iii) searching for the logs accumulated in the log storage unit, and specifying a library function which has generated data to which the obtained tag has been set; repeating steps (ii) and (iii) with respect to the library function specified in step (iii); and referring to the logs accumulated in the log storage unit and, when there is not data input to the library function found in step (i) and the tag is not set to the input data, specifying the library function as a function which has generated the obfuscation data.