1. A computing device configured to execute an instruction set, the computing device comprising: a system call hooker configured to hook system calls that occur by the instruction set while the instruction set is executed; a category extractor configured to extract a category to which each of the hooked system calls belongs, with reference to category information associated with a correspondence relationship between a system call and a category; a sequence extractor configured to extract one or more behavior sequences expressed in an N-gram manner from a full sequence of the hooked system calls, with reference to the extracted category; and a model generator configured to generate a behavior pattern model of the system calls that occur when the instruction set is executed, based on a number of times that each of the extracted behavior sequences occurs.