1. A software operation modeling device implemented by a processor comprising: a function call order obtaining unit configured to determine an issuing order of function calls executed in each of specific events in the course of executing software, the specific events each being assigned an identifier, the function call order obtaining unit including a stack information obtaining unit configured to obtain return addresses loaded on a stack at the time of occurrence of the specific event thereby defining an order in which the return addresses are loaded on the stack, to record the return addresses in an order of occurrence of the specific events, and to define the recorded return addresses as the issuing order of the function calls; and a model generator configured to statistically determine a co-occurrence relationship between a specific event and the issuing order of the function calls by determining differences between specific events having the same identifier, and to record the co-occurrence relationship as an operation model of the software.