Communication analysis system, analysis method, and recording medium

An analysis method for a computer to analyze communication performed in a network of a plurality of terminals in a predetermined environment, the plurality of terminals being a monitoring target, the analysis method comprising:

• obtaining past communication information from a communication information DB that holds the past communication information, the past communication information including information indicating past communication established at the monitoring target;
• extracting an unestablished communication link of communication that is not included in a whitelist created by learning communication established at the monitoring target and has not been established in the past communication information based on the past communication information obtained in the obtaining, the unestablished communication link including one or more communication links each being a prediction target;
• calculating a confidence level indicating a likelihood that the unestablished communication link extracted in the extracting will be established as a normal communication link in the future;
• and
• creating a NW graph as graph information for determining whether to add the communication link to the whitelist, using the unestablished communication link extracted in the extracting, the confidence level calculated in the calculating, and the past communication information obtained in the obtaining, the NW graph being a graph in which the unestablished communication link and information regarding the unestablished communication link are mapped.

A non-transitory computer-readable recording medium having recorded thereon a program for causing a computer to perform an analysis method for analyzing communication performed in a network of a plurality of terminals in a predetermined environment, the plurality of terminals being a monitoring target, the program causing the computer to execute:

• obtaining past communication information from a communication information DB that holds the past communication information, the past communication information including information indicating past communication established at the monitoring target;
• an unestablished extracting communication link of communication that is not included in a whitelist created by learning communication established at the monitoring target and has not been established in the past communication information based on the past communication information obtained in the obtaining, the unestablished communication link including one or more communication links each being a prediction target;
• calculating a confidence level indicating a likelihood that the unestablished communication link extracted in the extracting will be established as a normal communication link in the future;
• and
• creating a NW graph as graph information for determining whether to add the communication link to the whitelist, using the unestablished communication link extracted in the extracting, the confidence level calculated in the calculating, and the past communication information obtained in the obtaining, the NW graph being a graph in which the unestablished communication link and information regarding the unestablished communication link are mapped.