Analysis device, analysis method, and analysis program

An analysis method executed by an analysis device, the analysis method comprising:

• accumulating alerts of communication determined not to be normal communication on a basis of a model indicating a feature of normal communication;
• performing clustering of the alerts by using a feature amount of communication included in the accumulated alerts;
• determining, for each of clusters generated by the clustering, whether or not the cluster includes a same type of alert;
• and
• outputting a result of the clustering and a determination result as to whether or not each of the clusters includes the same type of alert.

A non-transitory computer readable storage medium having stored therein an analysis program causing a computer to execute a process comprising the steps of:

• accumulating alerts of communication determined not to be normal communication on a basis of a model indicating a feature of normal communication;
• performing clustering of the alerts by using a feature amount of communication included in the accumulated alerts;
• determining, for each of clusters generated by the clustering, whether or not the cluster includes a same type of alert;
• and
• outputting a result of the clustering and a determination result as to whether or not each of the clusters includes the same type of alert.