Log analysis device, log analysis method, and log analysis program
AssigneeNippon Telegraph and Telephone Corporation
InventorKensuke Nakata
Life of this patent
Estimating the term…
Abstract
A log acquirer acquires a communication log to be analyzed obtained from communications in a predetermined network. A log analyzer detects a terminal conforming to an analysis rule using a signature generated based on the characteristics of a communication log generated by a terminal infected with malware. A primary scorer and a secondary scorer calculate a score indicating the degree of threat for a detection result including the information on the terminal detected by the log analyzer and an analysis rule to which the terminal conforms using the information on the analysis rule and the information on the detection result. A detection result display unit outputs the detection result and the score calculated by the primary scorer and the secondary scorer.
Claims8
A log analysis device comprising:
- a memory;
- and a processor coupled to the memory and programmed to execute a process comprising:
- acquiring a communication log to be analyzed obtained from communications in a predetermined network;
- detecting a terminal conforming to an analysis rule using a signature generated based on a characteristic of a communication log generated by a terminal infected with malware;
- calculating a score indicating a degree of threat for a detection result including information on the terminal detected by the detecting and an analysis rule to which the terminal conforms using information on the analysis rule and information on the detection result;
- and
- outputting the detection result and the score calculated by the calculating,
- wherein the calculating includes calculating a continuity score indicating continuity of the detection result by making the continuity score larger as date and time when the detection is performed for a first time is in more distant past and as a number of times the detection is performed in a predetermined period of time is larger.
A log analysis method performed by a log analysis device, the log analysis method comprising:
- acquiring a communication log to be analyzed obtained from communications in a predetermined network;
- detecting a terminal conforming to an analysis rule using a signature generated based on a characteristic of a communication log generated by a terminal infected with malware;
- calculating a score indicating a degree of threat for a detection result including information on the terminal detected at the detecting and an analysis rule to which the terminal conforms using information on the analysis rule and information on the detection result;
- and
- outputting the detection result and the score calculated at the calculating,
- wherein the calculating includes calculating a continuity score indicating continuity of the detection result by making the continuity score larger as date and time when the detection is performed for a first time is in more distant past and as a number of times the detection is performed in a predetermined period of time is larger.
A non-transitory computer-readable recording medium having stored a program for log analysis program that causes a computer to execute a process comprising:
- acquiring a communication log to be analyzed obtained from communications in a predetermined network;
- detecting a terminal conforming to an analysis rule using a signature generated based on a characteristic of a communication log generated by a terminal infected with malware;
- calculating a score indicating a degree of threat for a detection result including information on the terminal detected by the detecting and an analysis rule to which the terminal conforms using information on the analysis rule and information on the detection result;
- and
- outputting the detection result and the score calculated by the calculating,
- wherein the calculating includes calculating a continuity score indicating continuity of the detection result by making the continuity score larger as date and time when the detection is performed for a first time is in more distant past and as a number of times the detection is performed in a predetermined period of time is larger.
Dependencies are inferred from the claim text.