Patent ID: 11907365
Assignee: NIPPON TELEGRAPH AND TELEPHONE CORPORATION
Field: Computer technology (Electrical engineering)
Classification: CPC G  H | IPC G  H

Claim 0:
1. An information processing device comprising:
a memory; and
a processor coupled to the memory and programmed to execute a process comprising:
extracting elements relating to actions of an attacker from each input log;
generating a parser based on definition information that defines the actions of the attacker in a formal grammar, the parser being configured to detect, from a log, a log string having a feature corresponding to an action defined by the definition information;
detecting, from a log consisting of the elements extracted by the extracting, log strings having features corresponding to the actions defined by the definition information by using the parser; and
reconstructing the log strings detected by the detecting, add a label indicating an action defined by the definition information to each of the reconstructed log strings, and output the labeled log strings as a log corresponding to a series of actions of the attacker.