An attack code detection apparatus comprising: a learning unit that as learning data, uses a known malicious data series including an ROP (Return Oriented Programming) chain and a known benign data series, and generates a probability model in which features of byte strings of malicious data strings are learnt and generates a probability model in which features of byte strings of benign data series are learnt; a preprocessing unit that analyzes for learning in advance a library file used in an ROP chain, and obtains as an offset dictionary a set including an address of an ROP gadget, which represents a piece of code in the library file, and an increment value of stack pointer at time of execution of the ROP gadget; and a detecting unit that determines that an unknown data series representing examination target is a malicious data series, if a likelihood ratio of a likelihood that the unknown data series includes an ROP chain by a likelihood that the unknown data series does not include an ROP chain is equal to or greater than a predetermined threshold, wherein the likelihood that the unknown data series includes an ROP chain is determined by multiplying a probability, based on the probability model in which features of byte strings of malicious data strings are learnt, that the unknown data series includes an ROP chain, by a probability determined based on the offset dictionary that the unknown data series does not cause an ROP chain violation and wherein the likelihood that the unknown data series does not include an ROP chain is based on the probability model in which features of byte strings of benign data series are learnt. a learning unit that as learning data, uses a known malicious data series including an ROP (Return Oriented Programming) chain and a known benign data series, and generates a probability model in which features of byte strings of malicious data strings are learnt and generates a probability model in which features of byte strings of benign data series are learnt; a preprocessing unit that analyzes for learning in advance a library file used in an ROP chain, and obtains as an offset dictionary a set including an address of an ROP gadget, which represents a piece of code in the library file, and an increment value of stack pointer at time of execution of the ROP gadget; and analyzes for learning in advance a library file used in an ROP chain, and obtains as an offset dictionary a set including an address of an ROP gadget, which represents a piece of code in the library file, and an increment value of stack pointer at time of execution of the ROP gadget; and a detecting unit that determines that an unknown data series representing examination target is a malicious data series, if a likelihood ratio of a likelihood that the unknown data series includes an ROP chain by a likelihood that the unknown data series does not include an ROP chain is equal to or greater than a predetermined threshold, wherein the likelihood that the unknown data series includes an ROP chain is determined by multiplying a probability, based on the probability model in which features of byte strings of malicious data strings are learnt, that the unknown data series includes an ROP chain, by a probability determined based on the offset dictionary that the unknown data series does not cause an ROP chain violation and wherein the likelihood that the unknown data series does not include an ROP chain is based on the probability model in which features of byte strings of benign data series are learnt. <EOS>