An information processing method includes classifying a log of a device into one of a plurality of groups based on a device status that indicates a state of the device controlled by a command included in a communication packet and detecting a low-and-slow attack for each group of the plurality of groups based on one or more logs classified into the group.