Patent ID: 7568232

Claim:
A malicious access-detecting apparatus for detecting malicious access made via networks on which monitoring devices are provided for monitoring the networks to detect network events, comprising: an event information-storing section to store event information defining the network events including at least one type of network event that occurs before a specified stage of a malicious access, the event information defining roles that senders and recipients of each network event play in one of a plurality of malicious apparatus groups involved in the malicious access; a monitoring information-collecting section to collect monitoring information including the detected network events from the monitoring devices; a malicious apparatus group-deriving section to retrieve an associated piece of the event information from said event information-storing section by using each detected network event in the collected monitoring information as a key, the associated piece being associated with the key, and derive, based on the retrieved pieces of the event information, apparatuses involved in relevant detected network events as a malicious access group, the relevant detected network events belonging to the at least one type of network event and including addresses of senders or recipients that are the same as the one of the plurality of malicious access groups; a malicious apparatus group-storing section to store group information on the plurality of malicious access groups, the group information including the derived malicious apparatuses classified according to the roles defined in the event information; and an output section to output a list of the plurality malicious apparatus groups.