An information processing apparatus includes a memory and a processor coupled to the memory. The processor is configured to acquire identification information of a process executed on a virtual machine and information indicating a behavior of the process at a time when the process is executed, and sequentially store the information in the memory. The processor is configured to refer to the information stored in the memory when a deployment of software in the virtual machine is detected, identify first identification information of a first process such that a change of the behavior at the time when the first process is executed before and after the deployment exceeds a predetermined first criterion. The processor is configured to notify the first identification information to a monitoring process that monitors an operation of the software.