To provide a log analyzing device capable of detecting an abnormality characterized in temporal characteristics of an event, and to provide a log analyzing program and a recording medium.
A log analyzer 103 reads logs from a storage 102, and generates distribution concerning events at the time of attack. The analyzer 103 generates logical statistical distribution on the basis of a mean value and standard deviation of this distribution, and calculates a correlation coefficient indicating the degree of correlation between the distribution of the events recorded in the predetermined period to be analyzed and the logical statistical distribution. If the value of the correlation coefficient is not less than a predetermined value, the analyzer 103 judges that an injustice occurs.
COPYRIGHT: (C)2005,JPO&NCIPI
JP2005038116A | ||||
JP2004220373A |
Masatake Shiga
Takashi Watanabe