An apparatus comprising: a memory; and a processor coupled to the memory, wherein the processor is configured to: specify a communication source device that performs traffic confirmation of communication with a plurality of devices (530, 532, 534, 536, 538), each of which is a target of a plurality of authentication processes conducted by the communication source device after performing the traffic confirmation of communication; specify the plurality of devices (530, 532, 534, 536, 538) as attack targets by a cyber attack; detect at a first device identified by a first IP address included in the plurality of devices a first attempt time of the plurality of authentication processes and a first number of log-in authentication attempts of the plurality of authentication processes; detect at a second device identified by a second IP address different from the first IP address included in the plurality of devices a second attempt time of the plurality of authentication processes and a second number of log-in authentication attempts of the plurality of authentication processes; determine whether a correlation exists between the first attempt time and the second attempt time and between the first number of log-in authentication attempts and the second number of log-in authentication attempts; decide that the communication source device is an attack source of the cyber attack in a case where the correlation exists; and reject the plurality of authentication processes when it is decided that the communication source device is the attack source of the cyber attack. a memory; and a processor coupled to the memory, wherein the processor is configured to: specify a communication source device that performs traffic confirmation of communication with a plurality of devices (530, 532, 534, 536, 538), each of which is a target of a plurality of authentication processes conducted by the communication source device after performing the traffic confirmation of communication; specify the plurality of devices (530, 532, 534, 536, 538) as attack targets by a cyber attack; detect at a first device identified by a first IP address included in the plurality of devices a first attempt time of the plurality of authentication processes and a first number of log-in authentication attempts of the plurality of authentication processes; detect at a second device identified by a second IP address different from the first IP address included in the plurality of devices a second attempt time of the plurality of authentication processes and a second number of log-in authentication attempts of the plurality of authentication processes; determine whether a correlation exists between the first attempt time and the second attempt time and between the first number of log-in authentication attempts and the second number of log-in authentication attempts; decide that the communication source device is an attack source of the cyber attack in a case where the correlation exists; and reject the plurality of authentication processes when it is decided that the communication source device is the attack source of the cyber attack. specify a communication source device that performs traffic confirmation of communication with a plurality of devices (530, 532, 534, 536, 538), each of which is a target of a plurality of authentication processes conducted by the communication source device after performing the traffic confirmation of communication; specify the plurality of devices (530, 532, 534, 536, 538) as attack targets by a cyber attack; detect at a first device identified by a first IP address included in the plurality of devices a first attempt time of the plurality of authentication processes and a first number of log-in authentication attempts of the plurality of authentication processes; detect at a second device identified by a second IP address different from the first IP address included in the plurality of devices a second attempt time of the plurality of authentication processes and a second number of log-in authentication attempts of the plurality of authentication processes; determine whether a correlation exists between the first attempt time and the second attempt time and between the first number of log-in authentication attempts and the second number of log-in authentication attempts; decide that the communication source device is an attack source of the cyber attack in a case where the correlation exists; and reject the plurality of authentication processes when it is decided that the communication source device is the attack source of the cyber attack.