LOG ANALYSIS SYSTEM

• US 20160197790A1
• Filed: 03/17/2016
• Published: 07/07/2016
• Est. Priority Date: 03/31/2014
• Status: Active Grant

• Current Assignee: LAC Co., Ltd.
• Original Assignee: LAC Co., Ltd.
• Inventors: TSUCHIYA, Kazuhide, ABE, Masamichi, KAGEYAMA, Tetsuya, WASHIO, Hiroyuki, UMAKI, Atsushi, SHIODE, Ippei, TAKECHI, Hiroshi, KAWAGUCHI, Hiroshi, KIMURA, Masahiro, FUJIMOTO, Hiroshi
• Granted Patent: US 10,164,839 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06Q 50/10 Services
• CPC Class Codes: H04L 12/6418 Hybrid transport
• CPC Class Codes: H04L 41/14 Network analysis or design
• CPC Class Codes: H04L 43/026 using flow identification
• CPC Class Codes: H04L 43/065 related to network devices
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection

Abstract

A log analysis system includes a first processor unit, a second processor unit, a third processor unit, and a fourth processor unit. The first processor unit normalizes the detection log acquired by an acquirer, allocating the detection log into predefined monitoring target units, and outputs the monitoring target units. The second processor unit appends common information based on a predefined rule to each of the monitoring target units of the detection log output from the first processor unit, arranges the monitoring target units into information granularities based on the content of the detection log and common information, and outputs the monitoring target units as analysis unit information. The third processor unit gathers the analysis unit information output from the second processor unit and setting detection target event candidates based on a predefined rule, and outputs the detection target event candidates and the determination results.

Claims

1. A log analysis system comprising:

a first processor unit configured to append common information to analysis target information generated by events;

the processor unit being configured to make information granularities uniform based on the contents of the analysis target information and the common information to output analysis unit information; and

a second processor unit configured to integrate the analysis unit information output from the first processor unit to generate detection target event candidates, the second processor unit being configured to determine whether or not the events have at least one specific quality, the events having generated the analysis target information specified by the detection target event candidates.

2. A log analysis method performed by one or more computers, the method comprising:

appending common information to analysis target information generated by events;

making information granularities uniform based on the contents of the analysis target information and the common information to output analysis unit information;

integrating the analysis unit information into detection target event candidates; and

determining whether or not the events have at least one specific quality, the events having generated the analysis target information specified by the detection target event candidates.

3. A computer program product comprising one or more computer programs embodied on a non-transitory computer readable medium, the one or more computer programs comprising codes for:

appending common information based on a first predefined rule to analysis target information generated by events;

making information granularities uniform based on the contents of the analysis target information and the common information to output analysis unit information;

integrating the analysis unit information into detection target event candidates; and

determining whether or not the events have at least one specific quality, the events having generated the analysis target information specified by the detection target event candidates.