Analysis rule adjustment device, analysis rule adjustment system, analysis rule adjustment method, and analysis rule adjustment program

An analysis rule adjustment system that adjusts an analysis rule used in analyzing a communication log to detect malicious communication through a network, the system comprising:

• a log storage device that acquires, normalizes and stores a communication log through a network to be defended and a communication log generated by malware;
• and
• an analysis rule adjustment device that adjusts the analysis rule by analyzing the communication log stored in the log storage device, wherein
• the analysis rule adjustment device includes:
• a log acquisition unit that acquires the communication log from the log storage device;
• a log analysis unit that analyzes the communication log acquired by the log acquisition unit on the basis of predetermined analysis rule and tuning condition;
• and
• a first analysis unit that analyzes an analysis result by the log analysis unit and calculates a recommended tuning value used in an adjustment of the predetermined analysis rule and satisfying the tuning condition.

An analysis rule adjustment method that adjusts an analysis rule used in analyzing a communication log to detect malicious communication through a network, the method comprising:

• acquiring a communication log through a network to be defended and a communication log generated by malware and storing the communication log in a log storage unit;
• acquiring the communication log stored in the log storage unit;
• analyzing the acquired communication log on the basis of predetermined analysis rule and tuning condition;
• and
• process of analyzing an analysis result of analyzing the acquired communication log and calculating a recommended tuning value that is used in an adjustment of the predetermined analysis rule and satisfies the tuning condition.

A non-transitory computer readable recording medium having stored therein a program which causes a computer to adjust an analysis rule used in analyzing a communication log to detect malicious communication through a network, the program comprising:

• acquiring a communication log through a network to be defended and a communication log generated by malware;
• analyzing the acquired communication log on the basis of predetermined analysis rule and tuning condition;
• and
• analyzing an analysis result of analyzing the acquired communication log and calculating a recommended tuning value that is used in an adjustment of the predetermined analysis rule and satisfies the tuning condition.