The extraction unit (151) extracts a specific request from among the requests that do not match the profile (13) for determining whether the request is an attack, based on the similarity with the request to the server. In addition, the determination unit (152) determines whether or not the specific request extracted by the extraction unit (151) satisfies a predetermined condition indicating that transmission is continued from a predetermined number or more of transmission sources. Do. Further, when the determination unit (152) determines that the specific request satisfies the predetermined condition, the control unit (12) re-learns the profile (13).
展开▼