An information processing apparatus (10) according to an aspect of the present invention includes a similarity determination unit (13) configured to determine a degree of similarity between first and second queries used for detection of behavior of malware, and an integration unit (14) configured to perform integration of the first and second queries according to a determination result from the similarity determination unit (13). The similarity determination unit (13) determines the degree of similarity between the first and second queries by using a first graph structure corresponding to the first query and a second graph structure corresponding to the second query. The integration unit (14) performs integration of the first and second queries by extracting a common part between the first graph structure and the second graph structure.