Malicious communication log detection device, malicious communication log detection method, and malicious communication log detection program

A malicious communication log detection method executed by a malicious communication log detection device, the method comprising:

• compressing, using a predetermined algorithm, first character strings representing characteristics of a communication log that is known to be malicious or benign, and second character strings obtained by coupling the first character strings with a character string representing a characteristic of a communication log as a classification target;
• calculating a score for determining whether the communication log as a classification target is malicious or benign based on a data size of the first character strings compressed at the step compressing and a data size of the second character strings compressed at the compressing;
• and
• determining whether the communication log as a classification target is malicious or benign based on the score calculated at the calculating and a predetermined parameter.

11 A non-transitory computer-readable recording medium including a stored program for malicious communication log detection program that causes a computer to execute a process comprising:

• compressing, using a predetermined algorithm, first character strings representing characteristics of a communication log that is known to be malicious or benign, and second character strings obtained by coupling the first character strings with a character string representing a characteristic of a communication log as a classification target;
• calculating a score for determining whether the communication log as a classification target is malicious or benign based on a data size of the first character strings compressed at the compressing and a data size of the second character strings compressed at the compressing;
• and
• determining whether the communication log as a classification target is malicious or benign based on the score calculated at the calculating and a predetermined parameter.