An unauthorized-access detecting apparatus that detects unauthorized access to a server that provides a service via a network includes a storing unit that stores a series of process request, which is made by an unauthorized user via an unauthorized client, as an unauthorized-access event string; and a judging unit that compares a new process request with the unauthorized-access event string stored in the storing unit, and judges whether the process request is the unauthorized access based on a result of comparison.