Information processing apparatus, method for determining activity and computer-readable medium

An information processing apparatus is provided with: a comparison unit that compares a communication by a terminal connected to a network with a pattern held in advance; a specification unit that specifies an evaluated value indicating a degree to which it is inferred that the terminal is used to conduct unauthorized activity, and a phase of unauthorized activity, in accordance with a comparison result; a holding unit that holds a maximum value of the evaluated value, for each phase, and for each terminal; and a determination unit that determines whether or not the terminal is used to conduct unauthorized activity, based on the maximum value of the evaluated value for each of the phases.