1. An analysis rule adjustment device that adjusts an analysis rule used in analyzing a communication log to detect malicious communication through a network, the device comprising: a log acquisition unit that acquires a communication log through a network to be defended and a communication log generated by malware; a log analysis unit that analyzes the communication log acquired by the log acquisition unit on the basis of predetermined analysis rule and tuning condition; and a first analysis unit that analyzes an analysis result by the log analysis unit and calculates a recommended tuning value used in an adjustment of the predetermined analysis rule and satisfying the tuning condition.