A detection system for determining whether an update of at least one application installed on at least one whitelisted host is legitimate is provided. The system includes an update management server and update detectors installed with the application(s). During a process that software automatic update occurs in each update detector and a corresponding update installation package is executed, the executed update installation package generates at least one updater corresponding to each application. Each update detector transmits report information which includes the information of the at least one updater and sampled executable files to the update management server. The update management server obtains a number of update detectors, having performed the update operation of each application, according to the report information of each update detector. If the number is greater than or equal to a threshold value, it is determined that the update is legitimate.