A device inputs a first source code, which is source code of the software to be monitored; builds the first source code to generate a first binary; generates a first CFG based on the first binary; embeds a tamper detection feature and tamper detection feature calling functions in a first source code based on the first CFG to generate a second source code, builds a second source code to generate a second binary; generates a second CFG based on the second binary; creates an allowed list based on the second binary and the second CFG, and outputs the second binary and the allowed list. Here, in creating the allowed list, the monitoring range for the tamper detection feature calling functions is determined based on the second CFG, and a list of hash values of the monitoring range for the tamper detection feature calling functions is created as an allowed list.