A log analyzing device arranged to conduct security management of a network to determine whether or not there is unauthorized access via a connection to the network, the log analyzing device comprising: a log information collecting unit arranged to collect log information and traffic information output from a plurality of communication devices (11 to 20) included in the network; a normalization processing unit arranged to normalize the log information and traffic information collected by the log information collecting unit; a log information analysis processing unit arranged to extract, and analyze according to a predetermined rule, from the normalized log information and traffic information, log information and traffic information that are based on the same connection from the plurality of communication devices (11 to 20), the log information analysis processing unit being arranged to extract log information and traffic information of a time series of a fixed time period from the normalized log information and traffic information, analyze the extracted log information and traffic information based on the rule, and calculate, if a specified event is detected that has a specified characteristic, a total of at least: a score corresponding to the number of times the specified event has occurred in a specified time period; a score based on an occurrence interval of the specified event; a score based on the order of occurrence of a plurality of the specified events and an occurrence interval of each of the specified events; a score based on a time period over which the specified event has not occurred in a specified time period; and a score based on a result of comparing quantities summed up for a specified time period among a plurality of specified items, and determine whether or not there is unauthorized access via the connection based on a comparison of the total of the scores with a predetermined reference value; and an event information notifying unit arranged to output event information including information on a total of the scores, based on a result of the determination by the log information analysis processing unit, wherein the total of the scores exceeding the predetermined reference value indicates that there is a risk equal to or greater than a threat level that has been set beforehand with respect to the unauthorized access. a log information collecting unit arranged to collect log information and traffic information output from a plurality of communication devices (11 to 20) included in the network; a normalization processing unit arranged to normalize the log information and traffic information collected by the log information collecting unit; a log information analysis processing unit arranged to extract, and analyze according to a predetermined rule, from the normalized log information and traffic information, log information and traffic information that are based on the same connection from the plurality of communication devices (11 to 20), the log information analysis processing unit being arranged to extract log information and traffic information of a time series of a fixed time period from the normalized log information and traffic information, analyze the extracted log information and traffic information based on the rule, and calculate, if a specified event is detected that has a specified characteristic, a total of at least: a score corresponding to the number of times the specified event has occurred in a specified time period; a score based on an occurrence interval of the specified event; a score based on the order of occurrence of a plurality of the specified events and an occurrence interval of each of the specified events; a score based on a time period over which the specified event has not occurred in a specified time period; and a score based on a result of comparing quantities summed up for a specified time period among a plurality of specified items, a score corresponding to the number of times the specified event has occurred in a specified time period; a score based on an occurrence interval of the specified event; a score based on the order of occurrence of a plurality of the specified events and an occurrence interval of each of the specified events; a score based on a time period over which the specified event has not occurred in a specified time period; and a score based on a result of comparing quantities summed up for a specified time period among a plurality of specified items, and determine whether or not there is unauthorized access via the connection based on a comparison of the total of the scores with a predetermined reference value; and an event information notifying unit arranged to output event information including information on a total of the scores, based on a result of the determination by the log information analysis processing unit, wherein the total of the scores exceeding the predetermined reference value indicates that there is a risk equal to or greater than a threat level that has been set beforehand with respect to the unauthorized access.