A non-transitory computer readable recording medium storing a computer executable program that, when executed by a computer, causes the computer to perform a cyber attack analysis support process, the cyber attack analysis support process comprising: when information of a first cyber attack event including information of malware is registered as a result of a detection of the malware within an information processing system to be monitored, searching for a second cyber attack event having a similarity relationship with the first cyber attack event by referring to a storage (33; 509) in which cyber attack event information on cyber attack events, in which one or more cyber attack event contents are associated with each of a plurality of elements of a tree structure, is registered previously; comparing first content of the respective elements of the cyber attack event information of the first cyber attack event and second content of the respective elements of the cyber attack event information of each of the cyber attack events; counting a number of pieces of contents in which the first content and the second content match with each other; and determining the cyber attack event having the number of pieces of contents which is equal to or more than a specific number as the second cyber attack event having the similarity relationship with the first cyber attack event; and generating display information of the first cyber attack event and the second cyber attack event for displaying on a display unit such that the respective elements of the cyber attack event information of the first cyber attack event are coupled with a line to the first cyber attack event provided in a first portion on the display unit, one or more contents of the respective elements of the cyber attack event information of the first cyber attack event are coupled with a line to the respective elements, the respective elements of the cyber attack event information of the second cyber attack event are coupled with a line to the second cyber attack event provided in a second portion on the display unit, one or more contents of the respective elements of the cyber attack event information of the second cyber attack event are coupled with a line to the respective elements, and the content of the respective elements of the cyber attack event information of the first cyber attack event and the content of the respective elements of the cyber attack event information of the second cyber attack event which match with each other are coupled with a line directly. when information of a first cyber attack event including information of malware is registered as a result of a detection of the malware within an information processing system to be monitored, searching for a second cyber attack event having a similarity relationship with the first cyber attack event by referring to a storage (33; 509) in which cyber attack event information on cyber attack events, in which one or more cyber attack event contents are associated with each of a plurality of elements of a tree structure, is registered previously; comparing first content of the respective elements of the cyber attack event information of the first cyber attack event and second content of the respective elements of the cyber attack event information of each of the cyber attack events; counting a number of pieces of contents in which the first content and the second content match with each other; and determining the cyber attack event having the number of pieces of contents which is equal to or more than a specific number as the second cyber attack event having the similarity relationship with the first cyber attack event; and generating display information of the first cyber attack event and the second cyber attack event for displaying on a display unit such that the respective elements of the cyber attack event information of the first cyber attack event are coupled with a line to the first cyber attack event provided in a first portion on the display unit, one or more contents of the respective elements of the cyber attack event information of the first cyber attack event are coupled with a line to the respective elements, the respective elements of the cyber attack event information of the second cyber attack event are coupled with a line to the second cyber attack event provided in a second portion on the display unit, one or more contents of the respective elements of the cyber attack event information of the second cyber attack event are coupled with a line to the respective elements, and the content of the respective elements of the cyber attack event information of the first cyber attack event and the content of the respective elements of the cyber attack event information of the second cyber attack event which match with each other are coupled with a line directly.