Abstract: Provided is a system whereby information on activities obtained by way of monitoring system access to input and output devices and storage devices in a terminal as well as information on activities executed by way of a terminal and obtained by way of monitoring communications through a network are associated with processes in the terminal that generated the activities, and if the activities are predetermined activities executed by the same or related processes, the system detects that unauthorized processes are running on the terminal.

Abstract: A storage unit 104 of an address management apparatus 100 stores translation information 104C that associates, one-to-one, a value that can be taken by data in a block of a translation object address, with its post-translation value. An address translation unit 1032 reads, from the translation information 104C, a post-translation value associated with a value indicated by data of each block defined in the translation object IP address. Data of each block of the translation object address is translated based on the read post-translation value. This improves security in cases where access log data is provided to a third party.