Log analysis device, log analysis method, and log analysis program

1. A non-transitory log analysis device comprising:

a memory; and

a processor coupled to the memory and programmed to execute a process comprising:

acquiring a first communication log obtained from communications in a predetermined network and a second communication log obtained from communications performed by malware;

extracting a field satisfying a predetermined condition from a plurality of the fields included in the second communication log;

generating a signature serving as a condition for detecting a terminal infected with the malware based on a field and a value included in the second communication log and in which a threshold value is set for the signature corresponding to occurrences of recording of a pair of the extracted field and the value in a communication to be analyzed;

acquiring information on the malware from a malware-sharing server, wherein the information is acquired as a report file including at least one of information on a file accessed by the malware, a command executed by the malware, behavior of the malware, and a detection result of anti-virus software on the malware;

adding the information on the malware to the signature;

analyzing the first communication log using the signature;

detecting the terminal infected with the malware based on the pair of the extracted field and the value being recorded in the first communication log at least the threshold number of times; and

displaying, in response to the detecting, a detection result obtained from the first communication log and the information on the malware added to the signature used in the analysis of the first communication log in a manner associated with each other.

2. The log analysis device according to claim 1 , wherein the displaying further displays information on the first communication log having a field and a value agreeing with the field and the value of the signature out of a plurality of the first communication logs.

3. The log analysis device according to claim 1 , further comprising:

receiving selection indicating whether the detection result is harmless; and

generating a condition based on the selection; and

determining whether the detection result is harmless based on whether the detection result satisfies the condition generated, wherein

the displaying displays, when the determining determines that the detection result is not harmless, the detection result and the information on the malware in a manner associated with each other.

4. The log analysis device according to claim 1 , further comprising initially generating a plurality of signatures, and excluding a signature among the plurality of signatures from being the generated signature based on having a number or a ratio of erroneous detections in the analysis of the first communication log equal to or larger than a predetermined value.

5. The log analysis device according to claim 1 , wherein the adding adds at least one of a file type, date and time of registration, a detection name, and operation information to the signature as the information on the malware.

6. The log analysis device according to claim 1 , wherein the threshold value is greater than 1.

7. A log analysis method performed by a log analysis device, the log analysis method comprising:

acquiring a first communication log obtained from communications in a predetermined network and a second communication log obtained from communications performed by malware;

extracting a field satisfying a predetermined condition from a plurality of the fields included in the second communication log;

generating a signature serving as a condition for detecting a terminal infected with the malware based on a field and a value included in the second communication log and in which a threshold value is set for the signature corresponding to occurrences of recording of a pair of the extracted field and the value in a communication to be analyzed;

acquiring information on the malware from a malware-sharing server, wherein the information is acquired as a report file including at least one of information on a file accessed by the malware, a command executed by the malware, behavior of the malware, and a detection result of anti-virus software on the malware;

adding the information on the malware to the signature;

analyzing the first communication log using the signature;

detecting the terminal infected with the malware based on the pair of the extracted field and the value being recorded in the first communication log at least the threshold number of times; and

displaying, in response to the detecting, a detection result obtained from the first communication log and the information on the malware added to the signature used in the analysis of the first communication log in a manner associated with each other.

8. A non-transitory computer-readable recording medium having stored a program for analysis that causes a computer to execute a process comprising:

acquiring a first communication log obtained from communications in a predetermined network and a second communication log obtained from communications performed by malware;

extracting a field satisfying a predetermined condition from a plurality of the fields included in the second communication log;

generating a signature serving as a condition for detecting a terminal infected with the malware based on a field and a value included in the second communication log and in which a threshold value is set for the signature corresponding to occurrences of recording of a pair of the extracted field and the value in a communication to be analyzed;

acquiring information on the malware from a malware-sharing server, wherein the information is acquired as a report file including at least one of information on a file accessed by the malware, a command executed by the malware, behavior of the malware, and a detection result of anti-virus software on the malware;

adding the information on the malware to the signature;

analyzing the first communication log using the signature;

detecting the terminal infected with the malware based on the pair of the extracted field and the value being recorded in the first communication log at least the threshold number of times; and

displaying, in response to the detecting, a detection result obtained from the first communication log and the information on the malware added to the signature used in the analysis of the first communication log in a manner associated with each other.