Patent ID: 7832010

Claim:
An unauthorized access program monitoring method for monitoring activity of an unauthorized access program in a network and isolating a detected unauthorized access program, comprising: obtaining a network management information from a network management information storage unit storing management information about network information collected from a computer or a network connection apparatus; analyzing the management information about network information collected from a computer or a network connection apparatus, and detecting a change of the management information about the network information specific to the activity of the unauthorized access program; generating alert information including a type of an apparatus whose management information about network information relating to the detection of the change is collected and address information about an apparatus suspected of performing activities of the unauthorized access program; analyzing from the alert information the type of an apparatus from which the management information about the network information relating to the detection of the change, and the address information about the computer or the network connection apparatus suspected of performing the activity of the unauthorized access program; generating an instruction to delete relayed information for a computer designated by the address information when the type of the apparatus is a computer, and generating an instruction to set a filter that cuts off the communication of the unauthorized access program to the network connection apparatus designated by the address information when the type of the apparatus is a network connection apparatus; and transmitting an instruction to delete the relayed information or an instruction to set the filter.