Abstract: A non-transitory computer-readable storage medium storing a program that causes a computer to execute processing, the processing including acquiring a first integrity level of a first process from an operating system at a first timing, acquiring a second integrity level of the first process from the operating system at a second timing after the first timing, comparing the second integrity level with the first integrity level, and outputting an alert that notifies a malware attack upon a determination that the second integrity level is higher than the first integrity level.

Abstract: An anomaly detection method includes, obtaining information indicating a parent-child relationship of a process, specifying a first name of a first parent process of the process and a second name of a second parent process of the first parent process on the basis of the information, determining whether each of the first name of the first parent process and the second name of the second parent process includes specific name, and outputting anomaly information in accordance with a result of the determining.

Abstract: A threat detection method includes storing path information of an existing file in a first storage in response to a start of an application, determining, in response to detection of an event of access to a first file, whether or not path information of the first file is stored in the first storage, storing the path information of the first file in a second storage when the path of the first file is not stored in the first storage, obtaining first threat information of a parent process of a first process in response to an event of generation of the first process, determining a threat level of the first process in accordance with both the first threat information and a result of determination of whether path information of a second file as a generation source of the first process is stored in the second storage.