An analysis method comprising: an event acquiring step of acquiring a log of events containing a request to a server; an event block creating step of, by using process IDs of processes having processed events contained in the log, creating a set of the request and events relevant to the request as an event block; and an attack detecting step of contrasting the event block that is created from the log of events in which an attack is to be detected with an event block that is created from normal events to calculate a degree of similarity and, when the degree of similarity is equal to or lower than a threshold, detecting the event block as an event block containing an event that is abnormal due to an attack, wherein the event block creating step includes creating the event block by using transmission source port numbers contained in the events, the event block creating step comprising an event correlator: checking a correlation between a process ID of an HTTP request event and a process ID of a network access event; correlating a DB access event whose contained transmission source port number matches the network access event; and if a difference in time of occurrence from the HTTP request event to the DB access event is equal to or smaller than a predetermined threshold, correlating the DB access event as an event relevant to the HTTP request event and the network access event. an event acquiring step of acquiring a log of events containing a request to a server; an event block creating step of, by using process IDs of processes having processed events contained in the log, creating a set of the request and events relevant to the request as an event block; and an attack detecting step of contrasting the event block that is created from the log of events in which an attack is to be detected with an event block that is created from normal events to calculate a degree of similarity and, when the degree of similarity is equal to or lower than a threshold, detecting the event block as an event block containing an event that is abnormal due to an attack, wherein the event block creating step includes creating the event block by using transmission source port numbers contained in the events, the event block creating step comprising an event correlator: checking a correlation between a process ID of an HTTP request event and a process ID of a network access event; correlating a DB access event whose contained transmission source port number matches the network access event; and if a difference in time of occurrence from the HTTP request event to the DB access event is equal to or smaller than a predetermined threshold, correlating the DB access event as an event relevant to the HTTP request event and the network access event. checking a correlation between a process ID of an HTTP request event and a process ID of a network access event; correlating a DB access event whose contained transmission source port number matches the network access event; and if a difference in time of occurrence from the HTTP request event to the DB access event is equal to or smaller than a predetermined threshold, correlating the DB access event as an event relevant to the HTTP request event and the network access event.