Abstract: It is possible to provide an unauthorized operation monitoring program for calculating a modified score by reflecting a suspicious value determined from a series of operations by a user who operates a computer in order to monitor an unauthorized operation on the computer. When a modified score that indicates probability of an unauthorized operation is calculated for an object event, a suspicious value (PSV) corresponding to the level of the calculated modified score is set. When a new event occurs next time, for the score (direct score) calculated for the new event, a modified score reflecting the PSV set for the previous event and a time difference between the previous event and the new event is calculated. When operations that the probability of the unauthorized operation is high are continuously performed, or when operations of which the suspicious value is high are repeated, a higher level of a modified score is calculated.

Abstract: A computer system and appertaining control method allow, when an operation of a computer is controlled in accordance with an authentication result due to biological information using an externally connected device, setting up an authentication authority regarding a plurality of users, and setting up an authority per application and operation. The authentication condition on a biological authentication needed per application or operation is stored in the externally connected device along with the biological information of a plurality of users for whom biological authentication is needed. When using an external computer, it is connected to the externally connected device which performs biological authentication.