| 摘要 |
PROBLEM TO BE SOLVED: To provide a malware estimation device and the like capable of more accurately estimating whether or not a malware infection has occurred.SOLUTION: A malware estimation device 101 includes: a similarity calculation unit 102 that calculates similarity indicating the degree of similarity or matching between history information 601 showing a history about input/output processing executed by software that is estimated to be malware and second history information showing a history about input/output processing executed by an information processing device 501; and an estimation unit 103 that estimates whether or not the information processing device 501 is infected with the malware, on the basis of the similarity.SELECTED DRAWING: Figure 1 |
