Analysis rule adjustment device, analysis rule adjustment system, analysis rule adjustment method, and analysis rule adjustment program

1. An analysis rule adjustment device that adjusts an analysis rule used in analyzing a communication log to detect malicious communication through a network, the device comprising:

circuitry configured to implement:

a log acquisition unit that acquires a communication log through a network to be defended and a communication log generated by malware;

a log analysis unit that analyzes each of the communication logs acquired by the log acquisition unit on the basis of each analysis rule included in a predetermined set of analysis rules and a tuning condition, the predetermined set of analysis rules and the tuning condition being used to analyze the same communication log; and

a first analysis unit that analyzes an analysis result on the basis of each analysis rule included in the predetermined set of analysis rules of the log analysis unit and calculates a recommended tuning value corresponding to each analysis rule included in the predetermined set of analysis rules and used in an adjustment of the predetermined set of analysis rules and satisfying the tuning condition, the predetermined set of analysis rules that has been adjusted by the recommended tuning value preventing intrusion of malicious communication into the network.

2. The analysis rule adjustment device according to claim 1 , wherein:

the first analysis unit simultaneously analyzes the analysis result.

3. The analysis rule adjustment device according to claim 1 , wherein the first analysis unit outputs the recommended tuning value as well as sample identification information uniquely identifying a sample detected when the recommended tuning value is applied.

4. The analysis rule adjustment device according to claim 3 , further comprising:

a second analysis unit, implemented as circuitry, that analyzes the recommended tuning value and the sample identification information output by the first analysis unit,

wherein:

the first analysis unit outputs the recommended tuning value and sample identification information for each analysis rule included in the predetermined set of analysis rules, and

the second analysis unit outputs a recommended rule set obtained by reducing the number of analysis rules included in the predetermined set of analysis rules on the basis of the sample identification information.

5. The analysis rule adjustment device according to claim 3 , further comprising:

a memory that stores the analysis result of the log analysis unit,

wherein the first analysis unit performs an analysis on a different set of analysis rules on the basis of the analysis result stored in the memory.

6. The analysis rule adjustment device according to claim 1 , wherein the log analysis unit receives designation of a predetermined range of parameters as the tuning condition and analyzes each of the communication logs with respect to the predetermined range being designated.

7. The analysis rule adjustment device according to claim 1 , further comprising:

a feedback unit, implemented as circuitry, that updates the predetermined set of analysis rules on the basis of the recommended tuning value calculated by the first analysis unit.

8. An analysis rule adjustment system that adjusts an analysis rule used in analyzing a communication log to detect malicious communication through a network, the system comprising:

log storage circuitry that acquires, normalizes and stores a communication log through a network to be defended and a communication log generated by malware; and

analysis rule adjustment circuitry that adjusts the analysis rule by analyzing each of the communication logs stored in the log storage circuitry,

wherein:

the analysis rule adjustment circuitry includes:

log acquisition circuitry that acquires each of the communication logs from the log storage circuitry;

log analysis circuitry that analyzes each of the communication logs acquired by the log acquisition circuitry on the basis of each analysis rule included in a predetermined set of analysis rules and a tuning condition, the predetermined set of analysis rules and the tuning condition being used to analyze the same communication log; and

first analysis circuitry that analyzes an analysis result on the basis of each analysis rule included in the predetermined set of analysis rules of the log analysis circuitry and calculates a recommended tuning value corresponding to each analysis rule included in the predetermined set of analysis rules and used in an adjustment of the predetermined set of analysis rules and satisfying the tuning condition, the predetermined set of analysis rules that has been adjusted by the recommended tuning value preventing intrusion of malicious communication into the network.

9. An analysis rule adjustment method that adjusts an analysis rule used in analyzing a communication log to detect malicious communication through a network, the method comprising:

acquiring, using circuitry, a communication log through a network to be defended and a communication log generated by malware and storing each of the communication logs in log storage circuitry;

acquiring, using circuitry, each of the communication logs stored in the log storage circuitry;

analyzing, using circuitry, each of the acquired communication logs on the basis of each analysis rule included in a predetermined set of analysis rules and a tuning condition, the predetermined set of analysis rules and the tuning condition being used to analyze the same communication log; and

analyzing, using circuitry, an analysis result of analyzing each of the acquired communication logs, on the basis of each analysis rule included in the predetermined set of analysis rules and calculating a recommended tuning value corresponding to each analysis rule included in the predetermined set of analysis rules and used in an adjustment of the predetermined set of analysis rules and satisfies the tuning condition, the predetermined set of analysis rules that has been adjusted by the recommended tuning value preventing intrusion of malicious communication into the network.

10. A non-transitory computer readable recording medium having stored therein a program which causes a computer to adjust an analysis rule used in analyzing a communication log to detect malicious communication through a network and prevent intrusion, the program comprising:

acquiring a communication log through a network to be defended and a communication log generated by malware;

analyzing each of the acquired communication logs on the basis of each analysis rule included in a predetermined set of analysis rules and a tuning condition, the predetermined set of analysis rules and the tuning condition being used to analyze the same communication log; and

analyzing an analysis result of analyzing each of the acquired communication logs, on the basis of each analysis rule included in the predetermined set of analysis rules and calculating a recommended tuning value corresponding to each analysis rule included in the predetermined set of analysis rules and used in an adjustment of the predetermined set of analysis rules and satisfies the tuning condition, the predetermined set of analysis rules that has been adjusted by the recommended tuning value preventing intrusion of malicious communication into the network.

11. The analysis rule adjustment device according to claim 1 , further comprising:

intrusion prevention circuitry to prevent malicious communication into the network using the predetermined analysis rule that has been adjusted by the recommended tuning value.

12. The analysis rule adjustment device according to claim 4 , further comprising:

intrusion prevention circuitry prevents the malicious communication into the network using the predetermined analysis rule that has been adjusted by the recommended tuning value and the recommended rule set.

13. The system according to claim 8 , further comprising:

intrusion prevention circuitry to prevent malicious communication into the network using the analysis rule that has been adjusted.

14. The method according to claim 9 , further comprising:

preventing malicious communication into the network using the predetermined analysis rule that has been adjusted by the recommended tuning value.

15. The non-transitory computer readable recording medium, according to claim 10 , wherein the program further comprises:

preventing malicious communication into the network using the predetermined analysis rule that has been adjusted by the recommended tuning value.