The present invention relates to a network unauthorized access 
analysis method, a network unauthorized access analysis apparatus utilizing this method and a computer-readable recording medium having a network unauthorized access analysis program recorded thereon, and is capable of 
processing arbitrary data, performing arbitrary communication between networks, easily dealing with an increase in a number of protocols and coping with arbitrary protocols. A network unauthorized access analysis 
system 50 for realizing these features analyzes an unauthorized access on a network performing communication between information communication stations by using a layered protocol and includes: a 
data collecting section 55 for capturing a packet PT transmitted on a network 3; a data creating section 56 for creating 
analysis data DT by setting parameters of layered modules according to a layered protocol based on information of a previously-read configuration file and 
processing the packet from the 
data collecting section by the layered modules; and a data analyzing section 57 for judging whether an unauthorized access is generated in the 
analysis data DT based on the content described in that file.