Unauthorized operation judgment system, unauthorized operation judgment method, and unauthorized operation judgment program

There is provided an unauthorized operation judgment system for judging whether an operation received by a computer is an unauthorized operation by referencing a profile to find a peculiar action. This system can cope with an unauthorized operation due to a change of a computer by an authorized user and an unauthorized operation by a new user whose user profile is not yet created. When a user executes a certain operation, the operation tendency and the operation tendency executed by the user are learned to create a node profile and a user profile, which are stored in a node profile state table and a user profile state table of each user, respectively. The node profile and the user profile thus created are referenced so as to perform deviation calculation between the operation received and the normal operation pattern, thereby judging whether the operation is peculiar and calculating the possibility of an unauthorized operation as a score value.