Abstract: The rule learning unit 81 performs rough sets analysis using training data that includes threat information including a plurality of explanatory variables representing a threat event and a discrimination result of discriminating the threat information, to learn a decision rule specifying the discrimination result depending on a combination of the explanatory variables. The input unit 82 inputs the threat information to be analyzed. The analysis unit 83 applies the input threat information to the decision rule to identify the discrimination result of the threat information, and the explanatory variable as a basis for the discrimination result.

Abstract: A query creation means 82 creates, in accordance with the threat event detected, at least one query for use in identification of, as a cause of a threat, an event caused by the user in the user terminal or an event that has occurred in the user terminal due to the threat from among events that the user becomes aware of. A query transmission and reception means 83 transmits the query created to the notification recipient associated with the user identified and receives an answer to the query from the user. An attack identification means 84 identifies, in an attack model representing phases of a series of attacks identified based on a type of the threat, a corresponding one of the phases based on the answer. A first response execution means 85 executes a first response to the threat indicated by the attack model in accordance with the phase identified.

Abstract: A user terminal displays on its display unit a target web page including an authentication information input field into which input authentication information is inputted by the user terminal. The user terminal judges first to third validity levels for a plurality of login history information by referring to a login information list and a service group information. The user terminal selects a corresponding process from a plurality of predetermined processes for the input authentication information based on existence or absence of the login history information in the first or second validity level and on a result of checking the input authentication information with login information in the login history information in the first to third validity levels. The user terminal executes the corresponding process.

Abstract: A user terminal displays on its display unit a target web page including an authentication information input field into which input authentication information is inputted by the user terminal. The user terminal judges first to third validity levels for a plurality of login history information by referring to a login information list and a service group information. The user terminal selects a corresponding process from a plurality of predetermined processes for the input authentication information based on existence or absence of the login history information in the first or second validity level and on a result of checking the input authentication information with login information in the login history information in the first to third validity levels. The user terminal executes the corresponding process.

Abstract: An entry auxiliary apparatus includes: an authentication entry detection unit, an adequacy determination unit and an entry auxiliary unit. The authentication entry detection unit detects a first authentication server URL included in data of a web page displayed. The adequacy determination unit compares the first authentication server URL with a second authentication server URL included in login information indicating an input history of authentication information and a third authentication server URL included in a service group. The service group, which includes a group of authentication server URLs locating authentication servers that authenticate with an identical authentication information, is related to the login information. The adequacy determination unit relates the login information to an adequacy level depending on a result of the comparison. The entry auxiliary unit assists input of authentication information into the web page based on the login information and the adequacy level.