An unauthorized intrusion analysis support apparatus including a processor and a memory, comprising an input part configured to receive an input of a field related to an unauthorized intrusion; a keyword extraction part corffigured to extract at least one word in the inputted field relevant to the unauthorized intrusion to an apparatus communicably coupled to a predetermined network from a text relevant to the unauthorized intrusion to the apparatus; a relevance degree assumption part configured to calculate a relevance degree between the extracted word and a mode of the unauthorized intrusion based on the extracted word and information on a word of the mode of the unauthorized intrusion in the inputted field and assume that the text is a text about the unauthorized intrusion in the inputted field when the calculated relevance degree is equal to or higher than a predetermined threshold; and an output part configured to output information indicating that the text is the text about the unauthorized intrusion in the field, wherein the unauthorized intrusion analysis support apparatus is characterized in that : the relevance degree assumption part uses information on words indicating at least one of an intrusion source, an intrusion method, an intruded part, and a type of communication network related to the unauthorized intrusion as the information on the mode of the unauthorized intrusion, and assumes that the text is the text about the unauthorized intrusion in the inputted field when the number of matches between the extracted words and the words indicating the mode of the unauthorized intrusion is a predetermined number or higher. an input part configured to receive an input of a field related to an unauthorized intrusion; a keyword extraction part corffigured to extract at least one word in the inputted field relevant to the unauthorized intrusion to an apparatus communicably coupled to a predetermined network from a text relevant to the unauthorized intrusion to the apparatus; a relevance degree assumption part configured to calculate a relevance degree between the extracted word and a mode of the unauthorized intrusion based on the extracted word and information on a word of the mode of the unauthorized intrusion in the inputted field and assume that the text is a text about the unauthorized intrusion in the inputted field when the calculated relevance degree is equal to or higher than a predetermined threshold; and an output part configured to output information indicating that the text is the text about the unauthorized intrusion in the field, wherein the unauthorized intrusion analysis support apparatus is characterized in that : the relevance degree assumption part uses information on words indicating at least one of an intrusion source, an intrusion method, an intruded part, and a type of communication network related to the unauthorized intrusion as the information on the mode of the unauthorized intrusion, and assumes that the text is the text about the unauthorized intrusion in the inputted field when the number of matches between the extracted words and the words indicating the mode of the unauthorized intrusion is a predetermined number or higher. the relevance degree assumption part uses information on words indicating at least one of an intrusion source, an intrusion method, an intruded part, and a type of communication network related to the unauthorized intrusion as the information on the mode of the unauthorized intrusion, and assumes that the text is the text about the unauthorized intrusion in the inputted field when the number of matches between the extracted words and the words indicating the mode of the unauthorized intrusion is a predetermined number or higher. <EOS>