Patent ID: 8892510

Claim:
A computer-readable, non-transitory medium storing an analysis program that causes a computer to execute a procedure, the procedure comprising: extracting a plurality of sequence candidates for communications related to unauthorized access performed between a plurality of information processing apparatuses on a basis of communication histories stored in a storage unit storing the communication histories between the plurality of information processing apparatuses; calculating and outputting an evaluation value representing a degree of probability that the respective plurality of sequence candidates are unauthorized accesses on a basis of normality of a transaction which is restorable by a second communication history excluding a first communication history corresponding to each of the plurality of sequence candidates, among the communication histories stored in the storage unit; and determining a time width to bring a request, which is received by each information processing apparatus for a plurality of communications dated in a specified time width encompassing a generation time of the unauthorized access among the communication histories stored in the storage unit, and a response, which is transmitted by the information processing apparatus in response to the request, into correspondence with each other, wherein the plurality of sequence candidates is extracted within the time width among the communication histories stored in the storage unit, and the evaluation value of each of the sequence candidates is calculated.