An acquisition unit acquires reception data. A first extraction unit extracts a domain name being a download domain name from the reception data. A second extraction unit extracts owner information indicating an owner of a public key certificate included in the reception data. A search unit searches a domain information search service using the owner information as a search key, and acquires a management domain name managed by the owner indicated by the owner information. A determination unit collates the management domain name with the domain name to determine whether a program included in the reception data is illegitimate.