A device includes a processor configured to accumulate a plurality of logs in the memory, by repeating a capturing process and a logging process, the logging process including extracting a source identifier of a source computer, a destination identifier of a destination computer, and an attribute parameter which is set in an attribute item regarding an operation for the destination computer by the source computer, execute a detection process of detecting a target computer and another infected computer, the detection process including extracting a first destination identifier and a first attribute parameter, from a first log having an identifier of the infected computer in the source identifier, and extracting a second source identifier and a second destination identifier, from a second log having the first attribute parameter in the attribute parameter, and output the first destination identifier, the second source identifier, and the second destination identifier.