Abstract: A connection destination malignancy determination system connected to the Internet through a network includes: a connection destination observation unit that observes a connection destination; a connection destination malignancy determination unit that determines a malignancy indicating the degree of maliciousness of the connection destination; and a countermeasure priority determination unit that determines a countermeasure priority indicating the degree of preferential countermeasure required based on the malignancy and an observation result of the connection destination.

Abstract: A computer system comprises an analysis module configured to execute dynamic analysis for a sample of a malicious program, and to output an analysis result including a coupling destination to and from which the malicious program communicates; a variation detection module configured to detect variation of the coupling destination based on results of cyclic observation of the coupling destination, and to output a result of the detection; and an information sharing module configured to store information output from the analysis module and information output from the variation detection module in a form that allows sharing among a plurality of external computers.