Anti-malware device, anti-malware system, anti-malware method, and recording medium in which anti-malware program is stored

An anti-malware system comprising:

• an anti-malware device including:
• a storage unit configured to store risk information in which there are associated a value indicating an attribution of a first information processing device configured to execute software, a value indicating an attribution of the software, and a value that depends on the attributions of the first information processing device and the software and that indicates a degree of risk when the software is executed by the first information processing device;
• a subject attribution collection unit configured to collect the value indicating the attribution of the first information processing device from outside;
• an object attribution collection unit configured to collect the value indicating the attribution of the software from outside;
• and
• a determination unit configured to determine that the software is malware when the value indicating the degree of risk satisfies a criterion, the value being obtained by comparing the risk information with the values collected by the subject attribution collection unit and the object attribution collection unit;
• and
• the first information processing device and the second information processing device.

An anti-malware method comprising, when storage unit stores risk information in which there are associated a value indicating an attribution of a first information processing device configured to execute software, a value indicating an attribution of the software, and a value that depends on the attributions of the first information processing device and the software and that indicates a degree of risk when the software is executed by the first information processing device:

• by a third information processing device,
• collecting the value indicating the attribution of the first information processing device from outside;
• collecting the value indicating the attribution of the software from outside;
• and
• determining that the software is malware when the value indicating the degree of risk satisfies a criterion, the value being obtained by comparing the risk information with the values collected, indicating the attribution of the first information processing device and the attribution of the software.

A non-transitory computer readable recording medium storing an anti-malware program for causing a computer accessible to storage unit for storing risk information in which there are associated a value indicating an attribution of a first information processing device configured to execute software, a value indicating an attribution of the software, and a value that depends on the attributions of the first information processing device and the software and that indicates a degree of risk when the software is executed by the first information processing device, to execute:

• a subject attribution collection process of collecting the value indicating the attribution of the first information processing device from outside;
• an object attribution collection process of collecting the value indicating the attribution of the software from outside;
• and
• a determination process of determining that the software is malware when the value indicating the degree of risk satisfies a criterion, the value being obtained by comparing the risk information with the values collected in the subject attribution collection process and the object attribution collection process.