Patent ID: 9407649
Filing Date: 2016-08-02
CPC Classification: H04L

Claim Text:
1. A log analysis device that classifies, based on a log collected from a network device, a plurality of attack target communication devices encountering attacks from an attack source communication device, the log analysis device comprising: a storage configured to store the log; and a processor configured to execute a process including the extracting the high-correlation communication device group includes extracting the high-correlation communication device group by extracting a clique from a graph that includes a vertex corresponding to information relating to the number of the encountered attacks in a time period, during which the encountered attacks were carried out and which includes the detection time and the detection period of time of each of the encountered attacks encountered by the plurality of attack target communication devices, and an edge given between vertexes corresponding to two of the plurality of attack target communication devices having a correlation coefficient equal to or greater than the prescribed threshold.