1. An unauthorized-access detecting apparatus that detects unauthorized access to a server that provides a service via a network, the unauthorized-access detecting apparatus comprising: a storing unit that stores an unauthorized-access event string including a series of process requests made by an unauthorized user in past times, and a transition probability and a time interval between two consecutive process requests included in the unauthorized-access event string; a receiving unit that receives a process request from a user; and a judging unit that judges whether an unauthorized access occurs or not by comparing the unauthorized-access event string stored in the storing unit with an event string including a series of process requests received by the receiving unit, and, when it is determined that the event string matches with at least a portion of the unauthorized-access event string, estimates an occurrence time of the unauthorized access by adding time intervals between process requests included in the unauthorized-access event string and estimates a probability of an occurrence of the unauthorized access by multiplying transition probabilities between process requests included in the unauthorized-access event string.