Abstract: An erroneous detection amount obtaining unit (110) obtains using an overall detection rule group corresponding to an overall phase group that configures a series of attack activities, an erroneous detection amount of each phase of when attack detection is performed. A final stages verification unit (121) verifies whether or not an erroneous detection amount of a final phases group satisfies a final stages limitation. An overall verification unit (123) verifies whether or not the erroneous detection amount of the overall phase group satisfies an overall limitation. In a case where the erroneous detection amount of the final phases group does not satisfy the final stages limitation, a final stages adjustment unit (122) adjusts a parameter value of each detection rule of a final stages detection rule group.

Abstract: A classification unit classifies, per attack log data of a plurality of pieces of attack log data, one or more pieces of log information included in the attack log data, by value set consisting of a value of a first element and a value of a second element, thereby generating one or more log information groups. An integration unit integrates, per log information group, one or more pieces of log information included in the log information group, thereby generating integrated data. An extraction unit extracts, per value set, in one or more value sets, that is common among the plurality of pieces of attack log data, common information from a plurality of pieces of integrated data corresponding to the plurality of pieces of attack log data. A generation unit generates one or more attack detection rules based on one or more pieces of common information.