Patent ID: 11907365
Assignee: NIPPON TELEGRAPH AND TELEPHONE CORPORATION
Field: Computer technology (Electrical engineering)
Classification: CPC G  H | IPC G  H

Claim 3:
4. A non-transitory computer-readable recording medium having stored therein an analysis program for causing a computer to execute a process comprising:
a step of extracting elements relating to actions of an attacker from each input log;
a step of generating a parser based on definition information that defines the actions of the attacker in a formal grammar, the parser being configured to detect, from a log, a log string having a feature corresponding to an action defined by the definition information;
a step of detecting, from a log consisting of the elements extracted at the step of extracting the elements, log strings having features corresponding to the actions defined by the definition information by using the parser; and
a step of reconstructing the log strings detected at the step of detecting the log strings, adding a label indicating an action defined by the definition information to each of the reconstructed log strings, and outputting the labeled log strings as a log corresponding to a series of actions of the attacker.