FIELD

The present invention relates to a log analysis device, a log analysis method, and a log analysis program.

BACKGROUND

Cyberattacks on various services and infrastructures via networks are now becoming more persistent using a great variety of methods, and their threat is increasing. It is, however, difficult to prevent infection completely. To address this, widely known are malware-infected terminal detection techniques for finding and disinfecting a malware-infected terminal at an early stage based on information on communications on the assumption that infection occurs.

Various malware-infected terminal detection techniques are known, including a technique of creating signatures based on a malicious list and behavior of communications using the results of a dynamic analysis of malware and analyzing a communication log to be protected, for example.

CITATION LIST

Non Patent Literature

Non Patent Literature 1: Kensuke Nakata, Kazufumi Aoki, Kazunori Kamiya, Susumu Kakuta, and Yoshihito Oshima, “A Method of Extracting Common Malware Communication Patterns from Dynamic Analysis Result,” Information Processing Society of Japan, Computer Security Symposium 2015

SUMMARY

Technical Problem

The conventional technique, however, has a problem in that it is difficult for an operator to determine whether to perform a detailed analysis and take an action based on a detection result of a log analysis. The conventional technique, for example, may notify the operator of a detection result of a log analysis and a signature used in the detection. In this case, the operator can obtain information on the detection result and the signature but fails to obtain information used to determine what kind of action the operator should take to the detection result. This mechanism makes it difficult for the operator to analyze the detection result and determine whether to perform a detailed analysis and take an action.

Solution to Problem

To solve a problem and to achieve an object, a log analysis device comprises: a log acquirer configured to acquire a first communication log obtained from communications in a predetermined network and a second communication log obtained from communications performed by malware; a signature generator configured to generate a signature serving as a condition for detecting a terminal infected with the malware based on a field and a value included in the second communication log; a malware information acquirer configured to acquire information on the malware; a malware information adder configured to add the information on the malware to the signature; a detector configured to analyze the first communication log using the signature and detect the terminal infected with the malware; and a display unit configured to display a detection result obtained from the first communication log by the detector and the information on the malware added to the signature used in the analysis of the first communication log in a manner associated with each other.

To solve a problem and to achieve an object, a log analysis method performed by a log analysis device, the log analysis method comprises: a step of acquiring a first communication log obtained from communications in a predetermined network and a second communication log obtained from communications performed by malware; a step of generating a signature serving as a condition for detecting a terminal infected with the malware based on a field and a value included in the second communication log; a step of acquiring information on the malware; a step of adding the information on the malware to the signature; a step of detecting the terminal infected with the malware by analyzing the first communication log using the signature; and a step of displaying a detection result obtained from the first communication log by the step of detecting and the information on the malware added to the signature used in the analysis of the first communication log in a manner associated with each other.

Advantageous Effects of Invention

The present invention enables an operator to readily determine whether to perform a detailed analysis and take an action based on a detection result of a log analysis.

