A software behavior modeling device (100) has: an event information acquisition part (110) which acquires event information showing a specific event generated during the execution of software; a stack information acquisition part (120) which acquires stack information stored in a call stack at a point of time of occurrence of the specific event; and a behavior model generation part (130) which generates the behavior model of the software by setting a score to a return address according to a storing position where the return address contained in the stack information is stored in the call stack, and modeling the relation between the specific event and an element with the storing position and the score.
