When a program consisting of a plurality of processes is installed in a device, its processing route in the case where the processes normally advance is built as a database, based on the knowledge of a program designer or the like. When the program is executed, routing information indicating the actual process flow along each process flow is generated. Before a new process is activated, the route till then is compared with the correct route stored in the database. If the route till then is abnormal, it is determined that the device is infected with a worm, and the communication port of a device in which the program is installed is cut off and the maintenance terminal is notified of the abnormality.