Abstract: An analysis device includes processing circuitry configured to perform parsing on a first character string based on a grammar described in a PEG in which a variable is associated with a predetermined terminal symbol, add, to the variable, an element in which a predetermined attribute is imparted to a part of the first character string, the part being a second character string analyzed as corresponding to the terminal symbol, extract an element that is latest from elements of each predetermined attribute from the variable, and determine whether the element extracted satisfies a predetermined condition regarding a context.

Abstract: An information processing device includes an element extraction unit that extracts elements relating to actions of an attacker from each input log, a generation unit that generates a parser based on definition information defining the actions of the attacker in a formal grammar, the parser detecting, from a log, a log string having a feature corresponding to an action defined by the definition information, a parsing unit that detects, from a log consisting of the elements extracted by the element extraction unit, log strings having features corresponding to the actions defined by the definition information by using the parser, and a reconstruction unit that reconstructs the log strings detected by the parsing unit, adds a label indicating an action defined by the definition information to each of the reconstructed log strings, and outputs the labeled log strings as a log corresponding to a series of actions of the attacker.

Abstract: A graph association system includes processing circuitry configured to construct a plurality of dependency graphs in which input logs are associated with each other, assign a tag to each of the dependency graphs constructed, and associate the dependency graphs with each other based on tags assigned.

Abstract: An analysis device includes processing circuitry configured to perform parsing on a first character string based on a grammar described in a PEG in which a variable is associated with a predetermined terminal symbol, add, to the variable, an element in which a predetermined attribute is imparted to a part of the first character string, the part being a second character string analyzed as corresponding to the terminal symbol, extract an element that is latest from elements of each predetermined attribute from the variable, and determine whether the element extracted satisfies a predetermined condition regarding a context.

Abstract: A communication device is installed in between a client terminal and a web server which performs communication with the client terminal. The communication device includes a memory, and processing circuitry coupled to the memory and configured to of information included in communication between the web server and the client terminal, perform obfuscation with respect to information related to web application, and send communication, which includes information obfuscated at the performing, to destination.

Abstract: An information processing device includes an element extraction unit that extracts elements relating to actions of an attacker from each input log, a generation unit that generates a parser based on definition information defining the actions of the attacker in a formal grammar, the parser detecting, from a log, a log string having a feature corresponding to an action defined by the definition information, a parsing unit that detects, from a log consisting of the elements extracted by the element extraction unit, log strings having features corresponding to the actions defined by the definition information by using the parser, and a reconstruction unit that reconstructs the log strings detected by the parsing unit, adds a label indicating an action defined by the definition information to each of the reconstructed log strings, and outputs the labeled log strings as a log corresponding to a series of actions of the attacker.

Abstract: A communication device is installed in between a client terminal and a web server which performs communication with the client terminal. The communication device includes a memory, and processing circuitry coupled to the memory and configured to of information included in communication between the web server and the client terminal, perform obfuscation with respect to information related to web application, and send communication, which includes information obfuscated at the performing, to destination.