An analysis rule adjustment device configured to adjust an analysis rule used in analyzing a communication log to detect malicious communication through a network, the device comprising: a log acquisition unit configured to acquire a first communication log through a network to be defended and a second communication log generated by malware; a log analysis unit configured to analyze the first and second communication logs on the basis of a predetermined analysis rule to obtain an analysis result, the predetermined analysis rule having a tuning parameter, wherein analyzing the first and second communication logs comprises, for each of a predetermined range of tuning parameter values at predetermined intervals: using the predetermined analysis rule applying the tuning parameter value, analyzing the first communication log to determine a false detection rate associated with the tuning parameter value, and using the predetermined analysis rule applying the tuning parameter value, analyzing the second communication log to determine a detection rate associated with the tuning parameter value; and a first analysis unit configured to analyze the analysis result by the log analysis unit and calculate a recommended tuning value used in an adjustment of the predetermined analysis rule, wherein the determined recommended tuning value is a tuning parameter value associated with a highest determined detection rate, among tuning parameter values associated with a false detection rate which is lower than a tolerance value, out of the plurality of tuning parameter values. a log acquisition unit configured to acquire a first communication log through a network to be defended and a second communication log generated by malware; a log analysis unit configured to analyze the first and second communication logs on the basis of a predetermined analysis rule to obtain an analysis result, the predetermined analysis rule having a tuning parameter, wherein analyzing the first and second communication logs comprises, for each of a predetermined range of tuning parameter values at predetermined intervals: using the predetermined analysis rule applying the tuning parameter value, analyzing the first communication log to determine a false detection rate associated with the tuning parameter value, and using the predetermined analysis rule applying the tuning parameter value, analyzing the second communication log to determine a detection rate associated with the tuning parameter value; and a first analysis unit configured to analyze the analysis result by the log analysis unit and calculate a recommended tuning value used in an adjustment of the predetermined analysis rule, wherein the determined recommended tuning value is a tuning parameter value associated with a highest determined detection rate, among tuning parameter values associated with a false detection rate which is lower than a tolerance value, out of the plurality of tuning parameter values. using the predetermined analysis rule applying the tuning parameter value, analyzing the first communication log to determine a false detection rate associated with the tuning parameter value, and using the predetermined analysis rule applying the tuning parameter value, analyzing the second communication log to determine a detection rate associated with the tuning parameter value; and a first analysis unit configured to analyze the analysis result by the log analysis unit and calculate a recommended tuning value used in an adjustment of the predetermined analysis rule, wherein the determined recommended tuning value is a tuning parameter value associated with a highest determined detection rate, among tuning parameter values associated with a false detection rate which is lower than a tolerance value, out of the plurality of tuning parameter values.