Malware analysis apparatus, malware analysis method, and malware analysis system

A malware analysis method of, by a processor, executing a program recorded in a memory, the method comprising:

• performing dynamic analysis and static analysis of analysis target malware;
• converting a result of the dynamic analysis and a result of the static analysis into natural language, and generating explanations of the analysis results;
• and
• generating information regarding a behavior of analysis target malware that is obtained by comparing the explanations generated respectively from the dynamic analysis and the static analysis.

A malware analysis system comprising:

• a malware analysis apparatus that analyzes analysis target malware;
• and
• a display apparatus that presents a result of analysis of the analysis target malware to an analyst;
• wherein the malware analysis apparatus includes:
• an analysis section that performs dynamic analysis and static analysis of the analysis target malware,
• a conversion section that converts a result of the dynamic analysis and a result of the static analysis into natural language, and generates explanations of the analysis results, and
• a generation section that generates information regarding a behavior of the analysis target malware, the information being obtained by comparing the explanations generated respectively from the dynamic analysis and the static analysis.