An attack analyzer comprising: a common log acquisition unit acquiring a common security log including: (a) abnormality information indicating an abnormality detected by an electronic control system mounted on a vehicle, and (b) a common abnormality position indicating an abnormality position of the abnormality converted to be common among the electronic control system and other electronic control systems, wherein said abnormality position of the abnormality is a position in the electronic control system where the abnormality has occurred; an attack / abnormality relationship table storage unit storing an attack / abnormality relationship table indicating a relationship among: (c) an attack type of an attack on the electronic control system, (d) predicted abnormality information indicating a predicted abnormality predicted to occur when the electronic control system is attacked, and (e) a common predicted abnormality position indicating a predicted abnormality position of the predicted abnormality converted to be common among the electronic control system and the other electronic control systems; an estimation unit estimating the attack type of the attack received by the electronic control system from a combination of the predicted abnormality information and the common predicted abnormality position corresponding to a combination of (a) the abnormality information and (b) the common abnormality position; and an output unit outputting attack information including the attack type. a common log acquisition unit acquiring a common security log including: (a) abnormality information indicating an abnormality detected by an electronic control system mounted on a vehicle, and (b) a common abnormality position indicating an abnormality position of the abnormality converted to be common among the electronic control system and other electronic control systems, wherein said abnormality position of the abnormality is a position in the electronic control system where the abnormality has occurred; (a) abnormality information indicating an abnormality detected by an electronic control system mounted on a vehicle, and (b) a common abnormality position indicating an abnormality position of the abnormality converted to be common among the electronic control system and other electronic control systems, wherein said abnormality position of the abnormality is a position in the electronic control system where the abnormality has occurred; an attack / abnormality relationship table storage unit storing an attack / abnormality relationship table indicating a relationship among: (c) an attack type of an attack on the electronic control system, (d) predicted abnormality information indicating a predicted abnormality predicted to occur when the electronic control system is attacked, and (e) a common predicted abnormality position indicating a predicted abnormality position of the predicted abnormality converted to be common among the electronic control system and the other electronic control systems; (c) an attack type of an attack on the electronic control system, (d) predicted abnormality information indicating a predicted abnormality predicted to occur when the electronic control system is attacked, and (e) a common predicted abnormality position indicating a predicted abnormality position of the predicted abnormality converted to be common among the electronic control system and the other electronic control systems; an estimation unit estimating the attack type of the attack received by the electronic control system from a combination of the predicted abnormality information and the common predicted abnormality position corresponding to a combination of (a) the abnormality information and (b) the common abnormality position; and an output unit outputting attack information including the attack type.