Log analysis device and method

A log analysis method for classifying, based on a log collected from a network device, a plurality of attack target communication devices receiving attacks from an attack source communication device, the log analysis method comprising:

• calculating, based on the log, a correlation coefficient relating to the number of attacks in a time period during which the attacks were carried out for a combination of the plurality of attack target communication devices, the time period including a detection time at which and a detection period of time during which the network device detected the attack;
• and
• extracting, as a high-correlation communication device group, a combination of the plurality of attack target communication devices, for which the correlation coefficient is equal to or greater than a prescribed threshold and of which the attack source communication device is identical in the time period.

A non-transitory computer-readable recording medium having stored therein a program for causing a computer to execute a process for classifying, based on a log collected from a network device, a plurality of attack target communication devices receiving attacks from an attack source communication device, the process comprising:

• calculating, based on the log, a correlation coefficient relating to the number of attacks in a time period during which the attacks were carried out for a combination of the plurality of attack target communication devices, the time period including a detection time at which and a detection period of time during which the network device detected the attack;
• and
• extracting, as a high-correlation communication device group, a combination of the plurality of attack target communication devices, for which the correlation coefficient is equal to or greater than a prescribed threshold and of which the attack source communication device is identical in the time period.