Identification apparatus, control method therefor, and storage medium

A control method for an identification apparatus for identifying a spread range of malware, the spread range being a set of media to which the malware has been spread, comprising:

• storing an operation history as a history of an operation executed in at least one information processing apparatus;
• acquiring malware spread information including information indicating malware;
• and
• identifying, based on the operation history, an intrusion route of the malware indicated by the malware spread information acquired in the acquiring,
• generating at least one piece of malware spread information corresponding to at least one operation included in the intrusion route in the operation history, and
• identifying the spread range of the malware by, for each of the at least one piece of malware spread information, identifying at least one operation of spreading the malware in the operation history by setting, as a direct or indirect start point, the malware indicated by the malware spread information.

A non-transitory computer-readable storage medium which stores a program for causing a computer to execute a control method for identifying a spread range of malware, the spread range being a set of media to which the malware has been spread, the method comprising:

• storing an operation history as a history of an operation executed in at least one information processing apparatus;
• acquiring malware spread information including information indicating malware;
• and
• identifying, based on the operation history, an intrusion route of the malware indicated by the malware spread information acquired in the acquiring,
• generating at least one piece of malware spread information corresponding to at least one operation included in the intrusion route in the operation history, and
• identifying the spread range of the malware by, for each of the at least one piece of malware spread information, identifying at least one operation of spreading the malware in the operation history by setting, as a direct or indirect start point, the malware indicated by the malware spread information.