The apparatus analyzes management information about network information collected from a computer and a router, detects a change in the management information specific to the activity of an unauthorized access program (worm), and generates alert information including a type of apparatus whose collected management information indicates the detected change and address information about an apparatus suspected of performing the activity of a worm. When the type of apparatus in the alert information refers to a computer, the apparatus generates an instruction to delete relayed information for the computer. When the type of apparatus refers to a network connection apparatus, the apparatus generates an instruction to set a filter for cutting off the communications of a worm with the network connection apparatus. Thus, the apparatus transmits the instructions.