DATA EXTRACTION PROGRAM, DATA EXTRACTION METHOD, AND INFORMATION PROCESSING APPARATUS

Abstract

To prevent extraction omission when a specific user's communication data is extracted.SOLUTION: An information processing device 101 acquires an identifier identifying a network (for example, VLAN) corresponding to a specific user. The information processing device 101 identifies an IP address corresponding to the specific user included in communication data including the acquired identifier, among network logs including multiple pieces of communication data. The information processing device 101 searches the network logs for communication data including the identified IP address. The information processing device 101 searches the network logs for encrypted communication establishment information. If the retrieved encrypted communication establishment information relates to the acquired identifier, the information processing device 101 determines communication data to be extracted from the retrieved communication data on the basis of, the encrypted communication establishment information.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present invention relates to a data extraction program, a data extraction method, and an information processing device. [Background technology]

[0002] In recent years, there are network devices that integrate functions required for IT (Information Technology) systems, such as routers, firewalls, load balancing, and bandwidth control. In addition, network logs recorded in network devices may be analyzed to check the communication status of customers or to identify the location of a failure. For example, a network log may contain information on multiple customers.

[0003] Prior art techniques include collecting log information in which a specific type of communication is known, extracting communications that meet extraction conditions from the collected log information, and deciding to adopt the extraction conditions when the ratio of the specific type of communication to the extracted communications is equal to or greater than a threshold. There is also a technique for identifying communications that are repeatedly performed on a network to be monitored. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] International Publication No. 2015 / 141640 [Patent Document 2] JP 2017-5746 A Summary of the Invention [Problem to be solved by the invention]

[0005] However, with conventional techniques, it is difficult to extract all communication data of a specific customer from a network log that contains communication data of multiple customers.

[0006] In one aspect, the present invention aims to prevent omission of extraction when extracting communication data of a specific user. [Means for solving the problem]

[0007] In one embodiment, a data extraction program is provided that obtains an identifier that identifies a network corresponding to a specific user, identifies an IP address corresponding to the specific user that is included in communication data including the obtained identifier from a network log that includes a plurality of communication data, searches for communication data that includes the identified IP address from the network log, searches for at least one of encrypted communication establishment information and cookie-related information from the network log, and if the searched information is related to the identifier, determines communication data to be extracted from the searched communication data based on the information. Effect of the Invention

[0008] Advantageous Effects of Invention According to one aspect of the present invention, it is possible to prevent omissions in extraction when extracting communication data of a specific user. [Brief description of the drawings]

[0009] [Figure 1] FIG. 1 is an explanatory diagram illustrating an example of a data extraction method according to an embodiment. [Diagram 2] FIG. 2 is an explanatory diagram showing an example of a system configuration of an information processing system 200. As shown in FIG. [Diagram 3] FIG. 3 is a block diagram showing an example of the hardware configuration of the log analysis device 201. As shown in FIG. [Figure 4] FIG. 4 is an explanatory diagram showing an example of the contents stored in the customer information DB 220. As shown in FIG. [Diagram 5] FIG. 5 is an explanatory diagram showing a first specific example of the network log L. As shown in FIG. [Figure 6] FIG. 6 is a block diagram showing an example of the functional configuration of the log analysis device 201. As shown in FIG. [Figure 7] FIG. 7 is an explanatory diagram showing a specific example of the log analysis result. [Figure 8] FIG. 8 is an explanatory diagram showing the extraction management table 800. [Figure 9A] FIG. 9A is an explanatory diagram (part 1) showing a second specific example of the network log L. [Figure 9B] FIG. 9B is an explanatory diagram (part 2) showing a second specific example of the network log L. [Figure 9C] FIG. 9C is an explanatory diagram (part 3) showing a second specific example of the network log L. [Figure 10A] FIG. 10A is an explanatory diagram (part 1) showing a first example of transition of the storage contents of the extraction management table 800. [Figure 10B] FIG. 10B is an explanatory diagram (part 2) showing a first transition example of the storage contents of the extraction management table 800. [Figure 10C] FIG. 10C is an explanatory diagram (part 3) showing a first transition example of the storage contents of the extraction management table 800. [Figure 10D] FIG. 10D is an explanatory diagram (part 4) showing a first transition example of the storage contents of the extraction management table 800. [Figure 11A] FIG. 11A is an explanatory diagram (part 1) showing a third specific example of the network log L. [Figure 11B] FIG. 11B is an explanatory diagram (part 2) showing a third specific example of the network log L. [Figure 11C] FIG. 11C is an explanatory diagram (part 3) showing a third specific example of the network log L. [Figure 11D] FIG. 11D is an explanatory diagram (part 4) showing a third specific example of the network log L. [Figure 11E] FIG. 11E is an explanatory diagram (part 5) showing a third specific example of the network log L. [Figure 12A] FIG. 12A is an explanatory diagram (part 1) showing a second example of transition of the storage contents of the extraction management table 800. In FIG. [Figure 12B] FIG. 12B is an explanatory diagram (part 2) showing a second example of transition of the storage contents of the extraction management table 800. [Figure 12C]FIG. 12C is an explanatory diagram (part 3) showing a second example of transition of the storage contents of the extraction management table 800. [Figure 12D] FIG. 12D is an explanatory diagram (part 4) showing a second example of transition of the storage contents of the extraction management table 800. [Figure 12E] FIG. 12E is an explanatory diagram (part 5) showing a second example of transition of the storage contents of the extraction management table 800. [Figure 12F] FIG. 12F is an explanatory diagram (part 6) showing a second transition example of the storage contents of the extraction management table 800. [Figure 12G] FIG. 12G is an explanatory diagram (part 7) showing a second example of transition of the storage contents of the extraction management table 800. [Figure 12H] FIG. 12H is an explanatory diagram (part 8) showing a second transition example of the storage contents of the extraction management table 800. [Figure 13A] FIG. 13A is an explanatory diagram (part 1) showing a fourth specific example of the network log L. [Figure 13B] FIG. 13B is an explanatory diagram (part 2) showing the fourth specific example of the network log L. [Figure 13C] FIG. 13C is an explanatory diagram (part 3) showing a fourth specific example of the network log L. [Figure 13D] FIG. 13D is an explanatory diagram (part 4) showing a fourth specific example of the network log L. [Figure 14A] FIG. 14A is an explanatory diagram (part 1) showing a third example of transition of the storage contents of the extraction management table 800. In FIG. [Figure 14B] FIG. 14B is an explanatory diagram (part 2) showing a third example of transition of the storage contents of the extraction management table 800. [Figure 14C] FIG. 14C is an explanatory diagram (part 3) showing a third example of transition of the storage contents of the extraction management table 800. [Figure 14D] FIG. 14D is an explanatory diagram (part 4) showing a third example of transition of the storage contents of the extraction management table 800. [Figure 14E] FIG. 14E is an explanatory diagram (part 5) showing a third example of transition of the storage contents of the extraction management table 800. [Figure 14F] FIG. 14F is an explanatory diagram (part 6) showing a third example of transition of the storage contents of the extraction management table 800. [Figure 14G] FIG. 14G is an explanatory diagram (part 7) showing a third example of transition of the storage contents of the extraction management table 800. [Figure 14H] FIG. 14H is an explanatory diagram (part 8) showing a third example of transition of the storage contents of the extraction management table 800. [Figure 15] FIG. 15 is a flowchart showing an example of a log analysis procedure of the log analysis device 201. [Figure 16] FIG. 16 is a flowchart (part 1) illustrating an example of a specific processing procedure of the primary extraction process. [Figure 17] FIG. 17 is a second flowchart illustrating an example of a specific processing procedure of the primary extraction process. [Figure 18] FIG. 18 is a third flowchart illustrating an example of a specific processing procedure of the primary extraction process. [Figure 19] FIG. 19 is a flowchart (part 4) illustrating an example of a specific processing procedure of the primary extraction process. [Figure 20] FIG. 20 is a flowchart (part 1) illustrating an example of a specific processing procedure of the first negotiation analysis processing. [Figure 21] FIG. 21 is a second flowchart illustrating an example of a specific processing procedure of the first negotiation analysis process. [Figure 22] FIG. 22 is a flowchart (part 1) illustrating an example of a specific processing procedure of the second negotiation analysis processing. [Diagram 23] FIG. 23 is a second flowchart illustrating an example of a specific processing procedure of the second negotiation analysis process. [Figure 24] FIG. 24 is a flowchart (part 1) illustrating an example of a specific procedure of the cookie analysis process. [Diagram 25] FIG. 25 is a second flowchart illustrating an example of a specific procedure of the cookie analysis process. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0010] DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, embodiments of a data extraction program, a data extraction method, and an information processing device according to the present invention will be described in detail with reference to the accompanying drawings.

[0011] (Embodiment) Fig. 1 is an explanatory diagram showing an example of a data extraction method according to an embodiment. In Fig. 1, an information processing device 101 is a computer that extracts communication data of a specific user from a network log. The network log is a log recorded by a network device and includes multiple pieces of communication data.

[0012] The communication data indicates the communication history of each user via a network such as the Internet (e.g., operation history to a server, etc.). The network device has functions such as a router, a firewall, load balancing, and bandwidth control. The network log is used, for example, to solve security problems and improve business operations.

[0013] When a network problem occurs for a certain customer, it may be necessary to extract the communication data of that customer from the network log in order to deal with the problem. Meanwhile, the network log may contain communication data of multiple customers. For this reason, for example, it may be possible to extract communication data containing a Virtual Local Area Network-ID (VLAN_ID) that indicates a specific customer from the network log.

[0014] A VLAN is an example of a logical network (virtual network) used by customers, and is formed by dividing one physical LAN into multiple virtual LANs. A VLAN_ID is an identifier that uniquely identifies a VLAN. There is a one-to-one correspondence between customers and VLAN_IDs. However, not all communication data necessarily includes a VLAN_ID, and it is not possible to extract all communication data relating to a specific customer from a network log using only the VLAN_ID.

[0015] For this reason, in the past, communication data relating to specific customers was extracted manually. However, manual extraction work is time-consuming and laborious. In addition, there is a problem that know-how and skill are required to extract only communication data relating to specific customers without omission. Furthermore, manual work may result in omission of data.

[0016] In this embodiment, therefore, a data extraction method for preventing omission of extraction when extracting communication data of a specific user from a network log including communication data of a plurality of users will be described. An example of processing of the information processing device 101 will be described below.

[0017] (1) The information processing device 101 acquires an identifier for identifying a network corresponding to a specific user. The specific user is, for example, a customer who has experienced a network trouble. The network corresponding to the specific user is a logical network used by the specific user, for example, a VLAN specific to the specific user.

[0018] In the example of FIG. 1, it is assumed that a specific user is "customer A" and a VLAN_ID "AA" corresponding to customer A is obtained.

[0019] (2) The information processing device 101 identifies an IP (Internet Protocol) address corresponding to a specific user, which is included in communication data including the acquired identifier from among a network log including multiple communication data. The IP address corresponding to a specific user is a client IP address (e.g., a connection source IP address) used by the specific user.

[0020] Specifically, for example, the information processing device 101 identifies communication data 111 including the VLAN_ID "AA" corresponding to the customer A from the network log 110. The network log 110 is an example of a network log to be analyzed. Then, the information processing device 101 identifies a client IP address included in the identified communication data 111.

[0021] In the example of FIG. 1, it is assumed that a client IP address “BB” corresponding to customer A is identified from communication data 111 including a VLAN_ID “AA” corresponding to customer A in the network log 110. In the example of FIG.

[0022] (3) The information processing device 101 searches the network log for communication data including the identified IP address. Specifically, for example, the information processing device 101 searches the network log 110 for communication data including the client IP address “BB” corresponding to the customer A.

[0023] In the example of FIG. 1, it is assumed that communication data 112-114 including a client IP address "BB" corresponding to customer A is found in the network log 110. However, the same user does not necessarily continue to use an IP address. Therefore, at this point, the communication data 112-114 including the client IP address "BB" is not necessarily communication data corresponding to customer A.

[0024] (4) The information processing device 101 searches the network log for at least one of encrypted communication establishment information and cookie-related information. Here, the encrypted communication establishment information is information that specifies that encrypted communication has been established. The encrypted communication establishment information includes, for example, a protocol message indicating the start of IKE (Internet Key Exchange) phase 1 negotiation communication.

[0025] The encrypted communication establishment information also includes, for example, a protocol message indicating the end of negotiation communication in IKE phase 1. IKE is a protocol for exchanging and managing encryption keys between devices on a network, and is one of the protocols that form IPsec (Security Architecture for Internet Protocol).

[0026] IPsec is a protocol for providing interoperable, high-quality encryption-based security services. IKE phase 1 is a process for performing encrypted communication based on the encryption algorithm, encryption key, and message authentication method set in the communication device, and exchanging "information for performing encrypted communication" for IKE phase 2. IKE phase 2 is a process for exchanging information required for encrypted communication to transfer actual data.

[0027] The cookie-related information is information for identifying a user and managing a session. The cookie-related information includes, for example, a cookie value. Here, an example will be described in which the encrypted communication establishment information is searched for among the encrypted communication establishment information and the cookie-related information.

[0028] Specifically, for example, the information processing device 101 searches the network log 110 for first communication data including a protocol message indicating the start of IKE phase 1 negotiation communication, and second communication data including a protocol message indicating the end of IKE phase 1 negotiation communication.

[0029] 1, it is assumed that first communication data 115 including a protocol message indicating the start of IKE phase 1 negotiation communication is found in the network log 110. It is also assumed that second communication data 116 including a protocol message indicating the end of IKE phase 1 negotiation communication is found in the network log 110.

[0030] (5) When the searched encrypted communication establishment information is related to the identifier, the information processing device 101 determines the communication data to be extracted from the searched communication data based on the encrypted communication establishment information. The communication data including the protocol message indicating the end of the IKE phase 1 negotiation communication includes, for example, a VLAN_ID corresponding to the user.

[0031] Therefore, the information processing device 101 judges, for example, whether or not the searched second communication data 116 includes the VLAN_ID "AA" corresponding to the customer A. If the VLAN_ID "AA" is not included, the information processing device 101 judges that the encrypted communication establishment information is not related to the VLAN_ID "AA".

[0032] On the other hand, if the VLAN_ID "AA" is included, the information processing device 101 determines that the encrypted communication establishment information is related to the VLAN_ID "AA". Then, if the second communication data 116 includes the VLAN_ID "AA", the information processing device 101 determines that the communication data included in the time range from the first communication data 115 to the second communication data 116, among the searched communication data 112 to 114, is the communication data to be extracted.

[0033] Here, the time range from the first communication data 115 to the second communication data 116 is the time range from the start of the negotiation of IKE phase 1 to the end of the negotiation of IKE phase 1. If the second communication data 116 includes the VLAN_ID “AA”, the first communication data 115 and the second communication data 116 indicate the successful establishment of IKE phase 1 for customer A.

[0034] The client IP address “BB” included in the time range from the first communication data 115 to the second communication data 116 can be identified as the client A. In other words, among the communication data 112 to 114, the communication data included in the time range from the first communication data 115 to the second communication data 116 can be said to be communication data related to the client A.

[0035] The time when the IKE phase 1 negotiation started is, for example, the time when the first communication data 115 was recorded, and is included in the first communication data 115. The time when the IKE phase 1 negotiation ended is, for example, the time when the second communication data 116 was recorded, and is included in the second communication data 116.

[0036] 1, the communication data 112 and 113 of the communication data 112 to 114 are included in the time range from the first communication data 115 to the second communication data 116. Therefore, the information processing device 101 determines the communication data 112 and 113 of the communication data 112 to 114 as the communication data to be extracted.

[0037] In this way, the information processing device 101 can use information that identifies the establishment of encrypted communication for a specific user to determine communication data to be extracted from communication data that includes the same IP address as the specific user's IP address. This makes it possible to prevent omissions when extracting communication data of a specific user from a network log that includes communication data of multiple users.

[0038] In the example of Figure 1, the information processing device 101 can extract customer A's communication data 112, 113 from communication data 112-114 in the network log 110 that includes the same IP address as customer A's IP address, by utilizing the range in which customer A's IKE phase 1 negotiation communication was performed.

[0039] This makes it possible to prevent omissions when extracting communication data of customer A from the network log 110. It also makes it possible to prevent erroneous extraction of communication data of other customers to whom the same IP address as that of customer A is assigned. Searching for cookie-related information from the network log will be described later with reference to FIG. 6.

[0040] (System configuration example of information processing system 200) Next, a system configuration example of an information processing system 200 according to an embodiment will be described. In the following description, a case where the information processing device 101 shown in Fig. 1 is applied to a log analysis device 201 in the information processing system 200 will be described as an example. The information processing system 200 is applied to, for example, an IT system used by multiple customers.

[0041] Fig. 2 is an explanatory diagram showing an example of a system configuration of an information processing system 200. In Fig. 2, the information processing system 200 includes a log analysis device 201, a network device 202, a plurality of customer servers 203, and a client terminal 204. In the information processing system 200, the log analysis device 201, the network device 202, the customer servers 203, and the client terminal 204 are connected via a wired or wireless network 210.

[0042] The network 210 is, for example, the Internet, a LAN (Local Area Network), or a WAN (Wide Area Network). Specifically, for example, a customer-side network to which the customer server 203 belongs is connected to the network device 202 via the Internet. The customer-side network is, for example, a VLAN. The log analysis device 201, the network device 202, and the client terminal 204 are connected via a LAN.

[0043] Here, the log analysis device 201 has a customer information DB (Database) 220, and extracts communication data of a specific user by analyzing a network log. The log analysis device 201 is, for example, a server. The contents stored in the customer information DB 220 will be described later with reference to FIG. 4.

[0044] The customer information DB 220 may be included in another computer accessible to the log analysis device 201. The other computer may be, for example, a server that realizes a service management system. In this case, the log analysis device 201 can refer to the customer information DB 220 by accessing the other computer.

[0045] In the following description, the network log recorded by the network device 202 may be referred to as "network log L."

[0046] The network device 202 is a computer that records a network log L. The network device 202 is, for example, a device that integrates functions such as a router, a firewall, load balancing, and bandwidth control. The network log L is information that represents a communication history of a user (customer) via the network 210. The network log L includes, for example, communication data of a plurality of customers. A specific example of the network log L will be described later with reference to, for example, FIG. 5.

[0047] The customer server 203 is a computer used by a user (customer). The user may be, for example, an individual, or may be a company or a department within a company. The communication data included in the network log L indicates, for example, the communication history of the customer (customer server 203) via the Internet.

[0048] The client terminal 204 is a computer used by an operator. The operator is, for example, a person who deals with network troubles of customers. The client terminal 204 has, for example, a Web browser and can display the analysis results of the network log L. The client terminal 204 is, for example, a PC (Personal Computer), a tablet PC, etc.

[0049] Here, the log analysis device 201 and the client terminal 204 are provided separately, but the present invention is not limited to this. For example, the log analysis device 201 may be realized by the client terminal 204. The information processing system 200 may include a plurality of network devices 202. The log analysis device 201, the network devices 202, and the customer server 203 may be realized by, for example, virtual machines.

[0050] (Example of hardware configuration of log analysis device 201) Next, an example of the hardware configuration of the log analysis device 201 will be described.

[0051] Fig. 3 is a block diagram showing an example of a hardware configuration of the log analysis device 201. In Fig. 3, the log analysis device 201 has a CPU (Central Processing Unit) 301, a memory 302, a disk drive 303, a disk 304, a communication I / F (Interface) 305, a portable recording medium I / F 306, and a portable recording medium 307. Furthermore, each component is connected to each other by a bus 300.

[0052] Here, the CPU 301 is responsible for the overall control of the log analysis device 201. The CPU 301 may have multiple cores. The memory 302 has, for example, a read only memory (ROM), a random access memory (RAM), and a flash ROM. Specifically, for example, the flash ROM stores an OS program, the ROM stores application programs, and the RAM is used as a work area for the CPU 301. The programs stored in the memory 302 are loaded into the CPU 301 to cause the CPU 301 to execute the coded processes.

[0053] The disk drive 303 controls reading / writing of data from / to the disk 304 under the control of the CPU 301. The disk 304 stores data written under the control of the disk drive 303. Examples of the disk 304 include a magnetic disk and an optical disk.

[0054] The communication I / F 305 is connected to the network 210 via a communication line, and is connected to an external computer (for example, the network device 202 and the client terminal 204 shown in FIG. 2) via the network 210. The communication I / F 305 manages the interface between the network 210 and the inside of the device, and controls the input and output of data from the external computer. For example, a modem or a LAN adapter can be used as the communication I / F 305.

[0055] The portable recording medium I / F 306 controls reading / writing of data from / to the portable recording medium 307 under the control of the CPU 301. The portable recording medium 307 stores data written under the control of the portable recording medium I / F 306. Examples of the portable recording medium 307 include a CD (Compact Disc)-ROM, a DVD (Digital Versatile Disk), and a USB (Universal Serial Bus) memory.

[0056] In addition to the above-mentioned components, the log analysis device 201 may have, for example, an input device, a display, etc. Also, the network device 202, the customer server 203, and the client terminal 204 shown in Fig. 2 can be realized by the same hardware configuration as the log analysis device 201. However, the client terminal 204 has, for example, an input device, a display, etc. in addition to the above-mentioned components.

[0057] (Storage contents of customer information DB220) Next, a description will be given of the stored contents of the customer information DB 220 of the log analysis device 201. The customer information DB 220 is realized by, for example, a storage device such as the memory 302 and the disk 304 of the log analysis device 201 shown in FIG.

[0058] Fig. 4 is an explanatory diagram showing an example of the contents stored in the customer information DB 220. In Fig. 4, the customer information DB 220 has fields for a customer ID, a customer name, and a VLAN_ID, and stores customer information (for example, customer information 400-1, 400-2) as records by setting information in each field.

[0059] Here, the customer ID is an identifier that uniquely identifies a customer. The customer name is the name of the customer. The VLAN_ID is an identifier that uniquely identifies a VLAN corresponding to a customer. For example, the customer information 400-1 indicates a customer ID "C1", a customer name "Customer A", and a VLAN_ID "33" of a user (customer).

[0060] The customer information may include, for example, a VLAN name, a management LAN connection source IP, a VPN (Virtual Private Network) adapter device name, and so on.

[0061] (Example of network log L) Next, a specific example of the network log L will be described.

[0062] Fig. 5 is an explanatory diagram showing a first specific example of the network log L. In Fig. 5, the network log L1 is an example of a log recorded by the network device 202 shown in Fig. 2, and includes a plurality of communication data (e.g., communication data 500-1, 500-2). The communication data indicates a communication history of a user (customer) via a network 210 such as the Internet.

[0063] In FIG. 5, the period from a date and time (year, month, date, time) to just before the next date and time indicates one piece of communication data. Also, in FIG. 5, one piece of communication data is written in multiple lines, but the line number changes for each communication data. For example, communication data 500-2 is data from 2020 Jun 12 07:54:19 to peer:28800 (sec) (dotted frame in FIG. 5). Also, communication data 500-2 is the communication data with line number "2".

[0064] The network log L1 includes communication data of multiple customers (users). The communication data includes, for example, time information and messages. The time information indicates the date and time when the communication data was recorded. The messages are messages included in packets transmitted and received by the customer server 203 shown in FIG. 2. The network log L1 may also include, for example, information such as errors detected by the network device 202. In the network log L1, multiple communication data are arranged in chronological order.

[0065] In addition, for convenience of explanation, in Figure 5, messages contained in the communication data of customer B in the network log L1 are represented as "customer B information," messages contained in the communication data of customer C are represented as "customer C information," and messages contained in the communication data of customer D are represented as "customer D information."

[0066] (Example of functional configuration of log analysis device 201) Fig. 6 is a block diagram showing an example of a functional configuration of the log analysis device 201. In Fig. 6, the log analysis device 201 includes a reception unit 601, an acquisition unit 602, a collection unit 603, an analysis unit 604, and an output unit 605. The reception unit 601 to the output unit 605 are functions that become a control unit, and specifically, the functions are realized by causing the CPU 301 to execute a program stored in a storage device such as the memory 302, the disk 304, or the portable recording medium 307 shown in Fig. 3, or by the communication I / F 305. The processing results of each functional unit are stored in a storage device such as the memory 302 or the disk 304.

[0067] The reception unit 601 receives extraction conditions. Here, the extraction conditions are conditions for specifying communication data to be extracted. For example, a customer ID or a customer name is specified as the extraction conditions. The extraction conditions may include, for example, information specifying the network log L to be analyzed. Specifically, for example, the reception unit 601 receives the extraction conditions from the client terminal 204 shown in FIG. 2, thereby receiving the received extraction conditions.

[0068] The acquisition unit 602 acquires an identifier for identifying a network corresponding to a specific user. The network is, for example, a VLAN. In the following description, the network corresponding to a specific user may be referred to as a "VLAN" and the identifier for identifying the network may be referred to as a "VLAN_ID".

[0069] Specifically, for example, the acquiring unit 602 refers to the customer information DB 220 shown in Fig. 4 and acquires the VLAN_ID corresponding to the customer ID and customer name included in the accepted extraction condition. For example, if the extraction condition includes the customer ID "C1", the VLAN_ID "33" corresponding to the customer ID "C1" is acquired.

[0070] The collection unit 603 collects a network log L. Specifically, for example, the collection unit 603 collects a network log L1 (see FIG. 5) from the network device 202 shown in FIG. 2. In addition, the collection unit 603 may collect the network log L1 by, for example, an operation input using an input device (not shown).

[0071] The analysis unit 604 extracts communication data of a specific user by analyzing the network log L collected by the collection unit 603. Specifically, for example, the analysis unit 604 includes an identification unit 611, a first search unit 612, a second search unit 613, a third search unit 614, and an extraction unit 615.

[0072] The identification unit 611 identifies an IP address corresponding to a specific user, which is included in communication data including the acquired VLAN_ID, from the network log L. The communication data including the acquired VLAN_ID is, for example, communication data including a host name including the acquired VLAN_ID.

[0073] Also, the communication data including the acquired VLAN_ID may be, for example, communication data including a protocol message including the acquired VLAN_ID. The IP address corresponding to a specific user is a client IP address used by the specific user. Here, the communication data including the VLAN_ID may include a server IP address in addition to the client IP address.

[0074] The server IP address is an IP address of the network device 202, and is, for example, a known IP address (fixed). Therefore, the identifying unit 611 identifies, for example, an IP address included in the communication data that is different from the IP address of the network device 202 (server IP address) as an IP address (client IP address) corresponding to a specific user.

[0075] In the following description, a specific user may be referred to as a "relevant customer", an IP address corresponding to the specific user may be referred to as a "client IP address of the relevant customer", and the acquired VLAN_ID may be referred to as a "relevant customer's VLAN_ID".

[0076] Specifically, for example, the identifying unit 611 searches the network log L1 for communication data including "host00xx." host00xx is a host name. Here, xx corresponds to the VLAN_ID of the relevant customer. Then, the identifying unit 611 identifies the client IP address included in the searched communication data.

[0077] The identifying unit 611 may also search the network log L1 for communication data including "ipsec-dynamic-rule(xx)". ipsec-dynamic-rule(xx) is a message that identifies the protocol of encrypted communication. Here, xx corresponds to the VLAN_ID of the relevant customer. Then, the identifying unit 611 identifies the client IP address included in the searched communication data.

[0078] The first search unit 612 searches for communication data including the identified client IP address from the network log L. In the following description, the communication data including the identified client IP address (client IP address of the relevant customer) searched for by the first search unit 612 may be referred to as "candidate communication data."

[0079] The second search unit 613 searches for encrypted communication establishment information from the network log L. The encrypted communication establishment information is information that specifies that encrypted communication has been established. The encrypted communication establishment information includes, for example, a first protocol message and a second protocol message.

[0080] The first protocol message is a message indicating the start of IKE phase 1 negotiation communication, for example, "PHASE1 negotiation begins." The second protocol message is a message indicating the end of IKE phase 1 negotiation communication, for example, "ISAKMP-SA has been established."

[0081] Specifically, for example, the second search unit 613 searches the network log L1 for first communication data including the first protocol message "PHASE1 negotiation begins". The second search unit 613 also searches for second communication data including the second protocol message "ISAKMP-SA has been established".

[0082] The extraction unit 615 determines the communication data including the VLAN_ID of the relevant customer as the communication data to be extracted. The communication data including the VLAN_ID of the relevant customer is, for example, communication data including "host00xx" or communication data including "ipsec-dynamic-rule(xx)". Here, xx corresponds to the VLAN_ID of the relevant customer.

[0083] Furthermore, when the retrieved encrypted communication establishment information is related to the VLAN_ID of the customer, the extraction unit 615 determines the communication data to be extracted from the retrieved candidate communication data based on the encrypted communication establishment information. Here, the communication data including the protocol message indicating the end of the IKE phase 1 negotiation communication includes, for example, a host name including a VLAN_ID corresponding to the user.

[0084] For this reason, for example, when the searched second communication data does not include the VLAN_ID of the corresponding customer (host name including the VLAN_ID of the corresponding customer), the extraction unit 615 determines that the encrypted communication establishment information is not related to the VLAN_ID of the corresponding customer. On the other hand, when the second communication data includes the VLAN_ID of the corresponding customer, the extraction unit 615 determines that the encrypted communication establishment information is related to the VLAN_ID of the corresponding customer.

[0085] Then, when the encrypted communication establishment information is related to the VLAN_ID of the corresponding customer, the extraction unit 615 determines, among the searched candidate communication data, the candidate communication data included in a first time range from the first communication data to the second communication data as the communication data to be extracted. The first time range is the time range from the time when the IKE phase 1 negotiation starts to the time when the negotiation ends.

[0086] The encrypted communication establishment information may include, for example, a third protocol message, a fourth protocol message, and a fifth protocol message. The third protocol message is a message indicating the start of IKE phase 2 negotiation communication, for example, "PHASE2 negotiation begins."

[0087] The fourth protocol message is a message indicating the end of the negotiation communication in the receiving direction of IKE phase 2, for example, "IPsec-SA has been established: (INBOUND)". The fifth protocol message is a message indicating the end of the negotiation communication in the sending direction of IKE phase 2, for example, "IPsec-SA has been established: (OUTBOUND)".

[0088] Specifically, for example, the second search unit 613 searches the network log L1 for third communication data including a third protocol message "PHASE2 negotiation begins". The second search unit 613 also searches for fourth communication data including a fourth protocol message "IPsec-SA has been established: (INBOUND)". The second search unit 613 also searches for fifth communication data including a fifth protocol message "IPsec-SA has been established: (OUTBOUND)".

[0089] Here, the communication data including the protocol message indicating the end of the IKE phase 2 negotiation communication (receiving direction, transmitting direction) includes, for example, a protocol message including a VLAN_ID corresponding to the user. Therefore, for example, when the searched fourth communication data and fifth communication data do not include the VLAN_ID of the corresponding customer (protocol message including the VLAN_ID of the corresponding customer), the extraction unit 615 determines that the encrypted communication establishment information is not related to the VLAN_ID of the corresponding customer.

[0090] On the other hand, if the fourth communication data and the fifth communication data contain the VLAN_ID of the corresponding customer, the extraction unit 615 determines that the encrypted communication establishment information is related to the VLAN_ID of the corresponding customer. Note that, if at least one of the fourth communication data and the fifth communication data is found, the extraction unit 615 determines that the encrypted communication establishment information is not related to the VLAN_ID of the corresponding customer.

[0091] Then, when the encrypted communication establishment information relates to the VLAN_ID of the customer in question, the extraction unit 615 determines, from the searched candidate communication data, the candidate communication data that is included in a second time range from the third communication data to the communication data with the latest recording time among the fourth communication data and the fifth communication data, as the communication data to be extracted.

[0092] Here, the second time range is a time range from the time when IKE phase 2 negotiation starts to the time when IKE phase 2 negotiation ends in both the inbound and outbound directions.

[0093] The third search unit 614 searches for cookie-related information from the network log L. The cookie-related information is information for identifying a user and managing a session, and includes, for example, a cookie value. Specifically, for example, the third search unit 614 searches the network log L1 for a communication data group including the same cookie value.

[0094] In addition, if the cookie-related information searched by the third search unit 614 is related to the VLAN_ID of the customer in question, the extraction unit 615 determines the communication data to be extracted from the candidate communication data searched by the first search unit 612 based on the cookie-related information.

[0095] Specifically, for example, the extraction unit 615 judges whether the searched communication data group includes communication data including the VLAN_ID of the relevant customer. The communication data including the VLAN_ID of the relevant customer is, for example, communication data including "host00xx". Here, xx corresponds to the VLAN_ID of the relevant customer.

[0096] Here, if communication data including the VLAN_ID of the corresponding customer is not included, the extraction unit 615 determines that the cookie-related information is not related to the VLAN_ID of the corresponding customer. On the other hand, if communication data including the VLAN_ID of the corresponding customer is included, the extraction unit 615 determines that the cookie-related information is related to the VLAN_ID of the corresponding customer.

[0097] Then, when the cookie-related information is related to the VLAN_ID of the customer, the extraction unit 615 determines, among the searched candidate communication data, the candidate communication data included in the third time range as the communication data to be extracted. Here, the third time range is the time range from the first communication data to the last communication data in the communication data group including the same cookie value.

[0098] For example, the client IP address included in the communication data including the VLAN_ID (host00xx) of the relevant customer can be identified as the IP address of the relevant customer. The same client IP address is used in the same session. Therefore, in the third time range, communication data including the same IP address as the client IP address of the relevant customer can be said to be communication data of the relevant customer.

[0099] Then, the extraction unit 615 extracts the communication data of the determined extraction target from the network log L. In this way, it is possible to extract only the communication data of the relevant customer from the network log L.

[0100] The output unit 605 outputs the extracted communication data. The output format of the output unit 605 may be, for example, storage in a storage device such as the memory 302 or the disk 304, transmission to another computer via the communication I / F 305, display on a display (not shown), or print output on a printer (not shown).

[0101] Specifically, for example, the output unit 605 transmits the log analysis result to the client terminal 204. The log analysis result is communication data of the extracted relevant customer. The client terminal 204 is, for example, a computer that transmitted the extraction conditions. As a result, the client terminal 204 can display the log analysis result on a screen or record it in a memory or the like. A specific example of the log analysis result will be described later with reference to FIG. 7.

[0102] The functional units of the log analysis device 201 described above may be realized by a plurality of computers (for example, the log analysis device 201 and the client terminal 204) in the information processing system 200. The log analysis device 201 may not have any of the first search unit 612, the second search unit 613, and the third search unit 614 of the analysis unit 604 described above. For example, the log analysis device 201 may have only the first search unit 612 and the second search unit 613, or may have only the third search unit 614.

[0103] (Example of log analysis results) Here, a specific example of the log analysis result will be described with reference to FIG.

[0104] FIG. 7 is an explanatory diagram showing a specific example of a log analysis result. In FIG. 7, log analysis result 700 shows the result of extracting only the communication data of the relevant customer from network log L1. Here, the relevant customer is assumed to be "customer A." Comparing network log L1 shown in FIG. 5 with log analysis result 700, it can be seen that customer B information, customer C information, customer D information, etc. have been excluded, and only the communication data of the relevant customer A (e.g., communication data 500-1, 500-2) has been extracted. Note that, as in FIG. 5, in FIG. 7, the period from a date and time (year, month, date, time) to just before the next date and time indicates one piece of communication data.

[0105] (Network log L analysis example) Next, a description will be given of an example of analysis of the network log L. First, a description will be given of the extraction management table 800 used by the log analysis device 201. The extraction management table 800 is realized by a storage device such as the memory 302 and the disk 304 shown in FIG.

[0106] Fig. 8 is an explanatory diagram showing an extraction management table 800. In Fig. 8, the extraction management table 800 has fields for line number, confirmed memo, primary memo, phase 1 memo, phase 2 memo, and cookie memo. By setting information in each field, extraction management information for each communication data included in the network log L is stored as a record. In the initial state, each field is empty.

[0107] Here, the line number is a line number in the network log L, and identifies the communication data included in the network log L. The confirmation memo is information for identifying the communication data determined as the extraction target. ON is set in the confirmation memo corresponding to the communication data determined as the extraction target.

[0108] The primary memo, phase 1 memo, phase 2 memo, and cookie memo are information for determining communication data to be extracted. The primary memo, phase 1 memo, phase 2 memo, and cookie memo will be described in detail later.

[0109] Hereinafter, a first analysis example of the network log L will be described with reference to FIGS. 9A to 9C and 10A to 10D.

[0110] 9A to 9C are explanatory diagrams showing a second specific example of the network log L. In Fig. 9A and Fig. 9B, the network log L2 is an example of a log recorded by the network device 202, and includes a plurality of communication data. Note that, for convenience of explanation, line numbers are shown in Fig. 9A to Fig. 9C.

[0111] Here, the network log L2 is the network log L to be analyzed. Also, assume that extraction conditions including a customer ID "C1" are received as the extraction conditions. In this case, the corresponding customer is "Customer A."

[0112] 10A to 10D are explanatory diagrams showing a first transition example of the storage contents of the extraction management table 800. Hereinafter, a case where extraction management information for each communication data included in the network log L1 is stored in the extraction management table 800 will be described with reference to FIGS. 10A to 10D.

[0113] Primary extraction process First, the log analysis device 201 refers to the customer information DB 220 (see FIG. 4) and acquires the VLAN_ID "33" corresponding to the customer ID "C1" of the relevant customer included in the extraction conditions.

[0114] Next, the log analysis device 201 searches the network log L2 for communication data including "host0033." Then, the log analysis device 201 writes "A" in the primary memo corresponding to the searched communication data in the extraction management table 800 (see FIG. 10A).

[0115] The VLAN_ID is a value unique to each customer. Therefore, communication data including "host0033" can be said to be communication data of the corresponding customer. Therefore, the log analysis device 201 writes "ON" in the confirmation memo corresponding to the searched communication data in the extraction management table 800 (see FIG. 10A).

[0116] For example, the communication data on the 9th line of the network log L2 includes "host0033." In this case, the log analysis device 201 writes "A" in the primary memo corresponding to the line number "9" of the extraction management table 800, and writes "ON" in the final memo corresponding to the line number "9" (see FIG. 10A).

[0117] Furthermore, the log analysis device 201 identifies the client IP address included in the communication data including the searched "host0033". For example, the communication data on the 9th line of the network log L2 includes the IP addresses "IpAdd153, IpAdd186". Here, "IpAdd153" is the IP address of the network device 202. In this case, the log analysis device 201 identifies "IpAdd186" as the client IP address. This client IP address can be said to be the IP address of the customer in question.

[0118] Next, the log analysis device 201 searches the network log L2 for communication data including the identified client IP address "IpAdd186". Then, the log analysis device 201 writes "B" in the primary memo corresponding to the searched communication data in the extraction management table 800 (see FIG. 10A).

[0119] For example, the communication data on the 8th line of the network log L2 includes "IpAdd186." In this case, the log analysis device 201 writes "B" in the primary memo corresponding to the line number "8" of the extraction management table 800 (see FIG. 10A).

[0120] Furthermore, the log analysis device 201 searches the network log L2 for communication data including "ipsec-dynamic-rule(33)". Then, the log analysis device 201 writes "C" in the primary memo corresponding to the searched communication data in the extraction management table 800 (see FIG. 10A). Note that if "B" has been written in the primary memo, the log analysis device 201 overwrites it with "C".

[0121] Moreover, the VLAN_ID is a value unique to each customer. Therefore, it can be said that the communication data including the "ipsec-dynamic-rule(33)" is the communication data of the corresponding customer. Therefore, the log analysis device 201 writes "ON" in the confirmation memo corresponding to the searched communication data in the extraction management table 800 (see FIG. 10A).

[0122] For example, the communication data in the second line of the network log L2 includes "ipsec-dynamic-rule(33)." In this case, the log analysis device 201 writes "C" in the primary memo corresponding to line number "2" in the extraction management table 800, and writes "ON" in the final memo corresponding to line number "2" (see FIG. 10A).

[0123] Furthermore, the log analysis device 201 identifies the client IP address included in the communication data including the searched "ipsec-dynamic-rule(33)". For example, the communication data in the second line of the network log L2 includes the IP addresses "IpAdd153, IpAdd147". "IpAdd153" is the IP address of the network device 202. Therefore, the log analysis device 201 identifies "IpAdd147" as the client IP address. This client IP address can be said to be the IP address of the customer in question.

[0124] Next, the log analysis device 201 searches the network log L2 for communication data including the identified client IP address "IpAdd147". Then, the log analysis device 201 writes "D" in the primary memo corresponding to the searched communication data in the extraction management table 800 (see FIG. 10A).

[0125] For example, the communication data in the first line of the network log L2 includes "IpAdd 147." In this case, the log analysis device 201 writes "D" in the primary memo corresponding to the line number "1" in the extraction management table 800 (see FIG. 10A).

[0126] Hereinafter, the communication data of the lines in which A, B, C, or D is written in the primary memo in the network log L2 will be searched for. By limiting the search target, the processing efficiency can be improved.

[0127] - IKE Phase 1 Negotiation Analysis Next, the log analysis device 201 searches the search target for communication data (first communication data) including the first protocol message "PHASE1 negotiation begins". Then, the log analysis device 201 writes "E" to the phase 1 memo corresponding to the searched communication data in the extraction management table 800 as the start of the negotiation (see FIG. 10B).

[0128] For example, the communication data on the 8th line of the network log L2 includes "PHASE1 negotiation begins." In this case, the log analysis device 201 writes "E" in the phase 1 memo corresponding to the line number "8" in the extraction management table 800 (see FIG. 10B).

[0129] Next, the log analysis device 201 searches the search target for communication data (second communication data) including the second protocol message "ISAKMP-SA has been established." Then, the log analysis device 201 writes "F" to the phase 1 memo corresponding to the searched communication data in the extraction management table 800 as the end of the negotiation (see FIG. 10B).

[0130] For example, the communication data on the 10th line of the network log L2 includes "ISAKMP-SA has been established." In this case, the log analysis device 201 writes "F" in the phase 1 memo corresponding to the line number "10" in the extraction management table 800 (see FIG. 10B).

[0131] Next, the log analysis device 201 judges whether or not "host0033" is included in the searched communication data (second communication data). For example, "host0033" is included in the communication data on the 10th line of the network log L2.

[0132] Here, if "host0033" is included, then IKE phase 1 has been successfully established for the customer, and the client IP address in the lines between phase 1 memo "E" and phase 1 memo "F" can be identified as the IP address of the customer. Therefore, the log analysis device 201 writes "ON" in the confirmation memo corresponding to the communication data between phase 1 memo "E" and phase 1 memo "F" (see FIG. 10B). However, blank lines (for example, the seventh line of network log L2) are excluded.

[0133] For example, the communication data in the 8th line of the network log L2 is included in the range from phase 1 memo "E" to phase 1 memo "F." In this case, the log analysis device 201 writes "ON" in the confirmation memo corresponding to the line number "8" in the extraction management table 800 (see FIG. 10B).

[0134] - IKE Phase 2 Negotiation Analysis Next, the log analysis device 201 searches the search target for communication data (third communication data) including the third protocol message "PHASE2 negotiation begins". Then, the log analysis device 201 writes "G" as the start of negotiation in the phase 2 memo corresponding to the searched communication data in the extraction management table 800 (see FIG. 10C).

[0135] For example, the communication data in the first line of the network log L2 includes "PHASE2 negotiation begins." In this case, the log analysis device 201 writes "G" in the phase 2 memo corresponding to the line number "1" in the extraction management table 800 (see FIG. 10C).

[0136] Next, the log analysis device 201 searches the search target for communication data (fourth communication data) including the fourth protocol message "IPsec-SA has been established: (INBOUND)". Then, the log analysis device 201 writes "H" to the phase 2 memo corresponding to the searched communication data in the extraction management table 800 as the end of the negotiation (see FIG. 10C).

[0137] For example, the communication data in the third line of the network log L2 includes "IPsec-SA has been established: (INBOUND)". In this case, the log analysis device 201 writes "H" in the phase 2 memo corresponding to the line number "3" in the extraction management table 800 (see FIG. 10C).

[0138] Furthermore, the log analysis device 201 searches the search target for communication data (fifth communication data) including a fifth protocol message "IPsec-SA has been established: (OUTBOUND)". Then, the log analysis device 201 writes "I" to the phase 2 memo corresponding to the searched communication data in the extraction management table 800 as the end of the negotiation (see FIG. 10C).

[0139] For example, the communication data on the fifth line of the network log L2 includes "IPsec-SA has been established: (OUTBOUND)". In this case, the log analysis device 201 writes "I" in the phase 2 memo corresponding to the line number "5" in the extraction management table 800 (see FIG. 10C).

[0140] Next, the log analysis device 201 determines whether the searched communication data (the fourth communication data and the fifth communication data) includes "ipsec-dynamic-rule(33)." For example, the communication data in the third and fifth lines of the network log L2 includes "ipsec-dynamic-rule(33)."

[0141] Here, if "ipsec-dynamic-rule(33)" is included, then IKE phase 2 has been successfully established for the customer, and the client IP address in the lines between phase 2 memo "G" and phase 2 memo "I" (G~H~I) can be identified as the IP address of the customer. Therefore, the log analysis device 201 writes "ON" in the confirmation memo corresponding to the communication data between phase 2 memo "G" and phase 2 memo "I" (G~H~I) (see FIG. 10C). However, blank lines are excluded.

[0142] For example, the communication data in the first line of the network log L2 is a line included in the range (G-H-I) from phase 2 memo "G" to phase 2 memo "I." In this case, the log analysis device 201 writes "ON" in the confirmation memo corresponding to the line number "1" in the extraction management table 800 (see FIG. 10C).

[0143] - Analysis of validity range based on cookie values Next, the log analysis device 201 searches the search target for a communication data group that includes the same cookie value. Then, the log analysis device 201 writes a "cookie ID" to the cookie memo corresponding to the searched communication data in the extraction management table 800 (see FIG. 10D). The cookie ID is an identifier (e.g., J, K) that identifies a communication data group that includes the same cookie value.

[0144] For example, the communication data on lines 9, 10, 14, 16, and 17 of the network log L2 contains the same cookie value "6278bc68d344f112." In this case, the log analysis device 201 writes "J" into the cookie memo corresponding to line numbers "9, 10, 14, 16, and 17" in the extraction management table 800 (see FIG. 10D).

[0145] Next, the log analysis device 201 judges whether the searched communication data group includes communication data including "host0033". The client IP address of the communication data including "host0033" is the IP address of the corresponding customer. For example, the communication data on the 9th line of the network log L2 includes "host0033". Therefore, it can be said that the client IP address "IpAdd186" of the communication data on the 9th line is the IP address of the corresponding customer.

[0146] Therefore, the log analysis device 201 writes "ON" in the confirmation memo corresponding to the communication data including the same IP address as the client IP address from the first communication data to the last communication data of the same cookie ID (see FIG. 10D).

[0147] For example, the communication data on line 11 of network log L2 includes an IP address that is the same as the client IP address "IpAdd186" between the first communication data (line 9) and the last communication data (line 17) of cookie ID "J." In this case, the log analysis device 201 writes "ON" in the confirmation memo corresponding to line number "11" in the extraction management table 800 (see FIG. 10D).

[0148] In this way, it is possible to determine the communication data to be extracted from the network log L2. The log analysis device 201 refers to the extraction management table 800 shown in Fig. 10D and extracts the communication data with the confirmation memo "ON" from the network log L2, thereby extracting only the communication data of the relevant customer (customer A).

[0149] Next, a second analysis example of the network log L will be described with reference to FIGS. 11A to 11E and 12A to 12H.

[0150] 11A to 11E are explanatory diagrams showing a third specific example of the network log L. In Fig. 11A to 11E, the network log L3 is an example of a log recorded by the network device 202, and includes a plurality of communication data. Note that, for convenience of explanation, line numbers are displayed in Fig. 11A to 11E.

[0151] In the network log L3, for example, the communication data on lines 1 to 6 indicates the communication history performed for key exchange at the old address. The communication data on lines 7 to 16 indicates the communication history performed for a connection request at the new address. Thereafter, communication data such as that on lines 17 to 25 is repeatedly recorded. Furthermore, the communication data on line 114 indicates that the IPsec-SA at the old address has been deleted due to expiration of its Lifetime (24 hours). Furthermore, the communication data on line 117 indicates that an IPsec-SA at the new address has been established, making it possible to resume VPN (Virtual Private Network) communication.

[0152] Here, the network log L3 is the network log L to be analyzed. Also, assume that extraction conditions including a customer ID "C2" are received as the extraction conditions. In this case, the corresponding customer is "Customer B."

[0153] 12A to 12H are explanatory diagrams showing a second transition example of the storage contents of the extraction management table 800. Hereinafter, a case where extraction management information for each communication data included in the network log L3 is stored in the extraction management table 800 will be described with reference to FIGS. 12A to 12H.

[0154] Primary extraction process First, the log analysis device 201 refers to the customer information DB 220 (see FIG. 4) and acquires the VLAN_ID "223" corresponding to the customer ID "C2" of the relevant customer included in the extraction condition. Next, the log analysis device 201 searches the network log L3 for communication data including "host0223".

[0155] Then, the log analysis device 201 writes "A" in the primary memo corresponding to the searched communication data in the extraction management table 800 (see FIGS. 12A and 12B). The VLAN_ID is a value unique to a customer. Therefore, it can be said that communication data including "host0223" is communication data for the relevant customer. Therefore, the log analysis device 201 writes "ON" in the confirmation memo corresponding to the searched communication data in the extraction management table 800 (see FIGS. 12A and 12B).

[0156] For example, the communication data on the 8th line of the network log L3 includes "host0223." In this case, the log analysis device 201 writes "A" in the primary memo corresponding to the line number "8" of the extraction management table 800, and writes "ON" in the final memo corresponding to the line number "8" (see FIG. 12A).

[0157] Furthermore, the log analysis device 201 identifies the client IP address included in the communication data including the searched "host0223." For example, the communication data in the eighth line of the network log L3 includes the IP addresses "IpAdd153, IpAdd16." "IpAdd153" is the IP address of the network device 202. In this case, the log analysis device 201 identifies "IpAdd16" as the client IP address. This client IP address can be said to be the IP address of the customer in question.

[0158] Next, the log analysis device 201 searches the network log L3 for communication data including the identified client IP address "IpAdd16". Then, the log analysis device 201 writes "B" in the primary memo corresponding to the searched communication data in the extraction management table 800 (see FIGS. 12A and 12B).

[0159] For example, the communication data on the seventh line of the network log L3 includes "IpAdd16." In this case, the log analysis device 201 writes "B" in the primary memo corresponding to the line number "7" of the extraction management table 800 (see FIG. 12A).

[0160] Furthermore, the log analysis device 201 searches the network log L3 for communication data including "ipsec-dynamic-rule (223)". Then, the log analysis device 201 writes "C" in the primary memo corresponding to the searched communication data in the extraction management table 800 (see FIGS. 12A and 12B). Note that if "B" has been written in the primary memo, the log analysis device 201 overwrites it with "C".

[0161] Moreover, the VLAN_ID is a value unique to each customer. Therefore, it can be said that the communication data including the "ipsec-dynamic-rule (223)" is the communication data of the corresponding customer. Therefore, the log analysis device 201 writes "ON" in the confirmation memo corresponding to the searched communication data in the extraction management table 800 (see FIGS. 12A and 12B).

[0162] For example, the communication data in the second line of the network log L3 includes "ipsec-dynamic-rule(223)." In this case, the log analysis device 201 writes "C" in the primary memo corresponding to line number "2" in the extraction management table 800, and writes "ON" in the final memo corresponding to line number "2" (see FIG. 12A).

[0163] Furthermore, the log analysis device 201 identifies the client IP address included in the communication data including the searched "ipsec-dynamic-rule (223)". For example, the communication data in the second line of the network log L3 includes the IP addresses "IpAdd153, IpAdd67". "IpAdd153" is the IP address of the network device 202. Therefore, the log analysis device 201 identifies "IpAdd67" as the client IP address. This client IP address can be said to be the IP address of the customer in question.

[0164] Next, the log analysis device 201 searches the network log L3 for communication data including the identified client IP address "IpAdd67". Then, the log analysis device 201 writes "D" in the primary memo corresponding to the searched communication data in the extraction management table 800 (see FIGS. 12A and 12B).

[0165] For example, the communication data in the first line of the network log L2 includes "IpAdd67." In this case, the log analysis device 201 writes "D" in the primary memo corresponding to the line number "1" in the extraction management table 800 (see FIG. 12A).

[0166] Hereinafter, the communication data of the lines in which A, B, C, or D is written in the primary memo in the network log L3 will be searched for.

[0167] - IKE Phase 1 Negotiation Analysis Next, the log analysis device 201 searches the search target for communication data (first communication data) including the first protocol message "PHASE1 negotiation begins". Then, the log analysis device 201 writes "E" to the phase 1 memo corresponding to the searched communication data in the extraction management table 800 as the start of the negotiation (see FIGS. 12C and 12D).

[0168] For example, the communication data on the seventh line of the network log L3 includes "PHASE1 negotiation begins." In this case, the log analysis device 201 writes "E" to the phase 1 memo corresponding to the line number "7" in the extraction management table 800 (see FIG. 12C).

[0169] Next, the log analysis device 201 searches the search target for communication data (second communication data) including the second protocol message "ISAKMP-SA has been established." Then, the log analysis device 201 writes "F" to the phase 1 memo corresponding to the searched communication data in the extraction management table 800 as the end of the negotiation (see FIGS. 12C and 12D).

[0170] For example, the communication data on the 9th line of the network log L3 includes "ISAKMP-SA has been established." In this case, the log analysis device 201 writes "F" in the phase 1 memo corresponding to the line number "9" in the extraction management table 800 (see FIG. 12C).

[0171] Next, the log analysis device 201 judges whether or not "host0223" is included in the searched communication data (second communication data). For example, the communication data in the 9th line of the network log L3 includes "host0223".

[0172] Here, if "host0223" is included, then IKE phase 1 has been successfully established for the customer, and the client IP address in the lines between phase 1 memo "E" and phase 1 memo "F" can be identified as the IP address of the customer. Therefore, the log analysis device 201 writes "ON" in the confirmation memo corresponding to the communication data between phase 1 memo "E" and phase 1 memo "F" (see FIGS. 12C and 12D). However, blank lines are excluded.

[0173] For example, the communication data in the seventh line of the network log L3 is included in the range from phase 1 memo "E" to phase 1 memo "F." In this case, the log analysis device 201 writes "ON" in the confirmation memo corresponding to the line number "7" in the extraction management table 800 (see FIG. 12C).

[0174] - IKE Phase 2 Negotiation Analysis Next, the log analysis device 201 searches the search target for communication data (third communication data) including the third protocol message "PHASE2 negotiation begins". Then, the log analysis device 201 writes "G" as the start of negotiation in the phase 2 memo corresponding to the searched communication data in the extraction management table 800 (see FIGS. 12E and 12F).

[0175] For example, the communication data in the first line of the network log L3 includes "PHASE2 negotiation begins." In this case, the log analysis device 201 writes "G" in the phase 2 memo corresponding to the line number "1" in the extraction management table 800 (see FIG. 12E).

[0176] Next, the log analysis device 201 searches the search target for communication data (fourth communication data) including the fourth protocol message "IPsec-SA has been established: (INBOUND)". Then, the log analysis device 201 writes "H" to the phase 2 memo corresponding to the searched communication data in the extraction management table 800 as the end of the negotiation (see FIGS. 12E and 12F).

[0177] For example, the communication data in the third line of the network log L3 includes "IPsec-SA has been established: (INBOUND)". In this case, the log analysis device 201 writes "H" in the phase 2 memo corresponding to the line number "3" in the extraction management table 800 (see FIG. 12E).

[0178] Furthermore, the log analysis device 201 searches the search target for communication data (fifth communication data) including a fifth protocol message "IPsec-SA has been established: (OUTBOUND)". Then, the log analysis device 201 writes "I" to the phase 2 memo corresponding to the searched communication data in the extraction management table 800 as the end of the negotiation (see FIGS. 12E and 12F).

[0179] For example, the communication data on the fifth line of the network log L3 includes "IPsec-SA has been established: (OUTBOUND)". In this case, the log analysis device 201 writes "I" in the phase 2 memo corresponding to the line number "5" in the extraction management table 800 (see FIG. 12E).

[0180] Next, the log analysis device 201 judges whether or not the searched communication data (the fourth communication data and the fifth communication data) includes "ipsec-dynamic-rule (223)". For example, the communication data in the third and fifth lines of the network log L3 includes "ipsec-dynamic-rule (223)".

[0181] Here, if "ipsec-dynamic-rule(223)" is included, IKE phase 2 has been successfully established for the customer, and the client IP address in the lines between phase 2 memo "G" and phase 2 memo "I" (G~H~I) can be identified as the IP address of the customer. Therefore, the log analysis device 201 writes "ON" in the confirmation memo corresponding to the communication data between phase 2 memo "G" and phase 2 memo "I" (G~H~I) (see FIGS. 12E and 12F). However, blank lines are excluded.

[0182] For example, the communication data in the first line of the network log L3 is a line included in the range (G-H-I) from phase 2 memo "G" to phase 2 memo "I." In this case, the log analysis device 201 writes "ON" in the confirmation memo corresponding to the line number "1" in the extraction management table 800 (see FIG. 12E).

[0183] - Analysis of validity range based on cookie values Next, the log analysis device 201 searches the search target for a communication data group that includes the same cookie value. Then, the log analysis device 201 writes the "cookie ID" in the cookie memo corresponding to the searched communication data in the extraction management table 800 (see FIGS. 12G and 12H).

[0184] For example, the communication data on lines 8, 9, 13, 15, and 16 of the network log L3 includes the same cookie value “92b72df3e38fc2c0.” In this case, the log analysis device 201 writes “J” into the cookie memo corresponding to line numbers “8, 9, 13, 15, and 16” in the extraction management table 800 (see FIG. 12G).

[0185] Next, the log analysis device 201 judges whether the searched communication data group includes communication data including "host0223". The client IP address of the communication data including "host0223" is the IP address of the corresponding customer. For example, the communication data on the 8th line of the network log L3 includes "host0223". Therefore, it can be said that the client IP address "IpAdd16" of the communication data on the 8th line is the IP address of the corresponding customer.

[0186] Therefore, the log analysis device 201 writes “ON” in the confirmation memo corresponding to the communication data that includes the same IP address as the client IP address of the customer in question, from the first communication data to the last communication data of the same cookie ID (see Figures 12G and 12H).

[0187] For example, the communication data on the 10th line of the network log L3 includes an IP address that is the same as the client IP address "IpAdd16" between the first communication data (line 8) and the last communication data (line 16) of the cookie ID "J." In this case, the log analysis device 201 writes "ON" in the confirmation memo corresponding to line number "10" in the extraction management table 800 (see FIG. 12G).

[0188] In this way, it is possible to determine the communication data to be extracted from the network log L3. The log analysis device 201 refers to the extraction management table 800 shown in Figures 12G and 12H, and extracts the communication data of the confirmation memo "ON" from the network log L3, thereby extracting only the communication data of the relevant customer (customer B).

[0189] Next, a third analysis example of the network log L will be described with reference to FIGS. 13A to 13D and 14A to 14H.

[0190] Figures 13A to 13D are explanatory diagrams showing a fourth specific example of the network log L. In Figures 13A to 13D, the network log L4 is an example of a log recorded by the network device 202, and includes a plurality of communication data. Note that, for convenience of explanation, line numbers are displayed in Figures 13A to 13D.

[0191] Here, the network log L4 is the network log L to be analyzed. Also, assume that extraction conditions including a customer ID "C1" are received as the extraction conditions. In this case, the corresponding customer is "Customer A."

[0192] 14A to 14H are explanatory diagrams showing a third transition example of the storage contents of the extraction management table 800. Hereinafter, a case where extraction management information for each communication data included in the network log L4 is stored in the extraction management table 800 will be described with reference to FIGS. 14A to 14H.

[0193] Primary extraction process First, the log analysis device 201 refers to the customer information DB 220 (see FIG. 4) and acquires the VLAN_ID "33" corresponding to the customer ID "C1" of the relevant customer included in the extraction condition. Next, the log analysis device 201 searches the network log L4 for communication data including "host0033".

[0194] Then, the log analysis device 201 writes "A" in the primary memo corresponding to the searched communication data in the extraction management table 800 (see FIGS. 14A and 14B). The VLAN_ID is a value unique to a customer. Therefore, it can be said that communication data including "host0033" is communication data for the relevant customer. Therefore, the log analysis device 201 writes "ON" in the confirmation memo corresponding to the searched communication data in the extraction management table 800 (see FIGS. 14A and 14B).

[0195] For example, the communication data on the 9th line of the network log L4 includes "host0033." In this case, the log analysis device 201 writes "A" in the primary memo corresponding to the line number "9" of the extraction management table 800, and writes "ON" in the final memo corresponding to the line number "9" (see FIG. 14A).

[0196] Furthermore, the log analysis device 201 identifies the client IP address included in the communication data including the searched "host0033." For example, the communication data on the eighth line of the network log L4 includes the IP addresses "IpAdd153, IpAdd186." "IpAdd153" is the IP address of the network device 202. In this case, the log analysis device 201 identifies "IpAdd186" as the client IP address. This client IP address can be said to be the IP address of the customer in question.

[0197] Next, the log analysis device 201 searches the network log L4 for communication data including the identified client IP address "IpAdd186". Then, the log analysis device 201 writes "B" in the primary memo corresponding to the searched communication data in the extraction management table 800 (see FIGS. 14A and 14B).

[0198] For example, the communication data on the 8th line of the network log L4 includes "IpAdd186." In this case, the log analysis device 201 writes "B" in the primary memo corresponding to the line number "8" of the extraction management table 800 (see FIG. 14A).

[0199] Furthermore, the log analysis device 201 searches the network log L4 for communication data including "ipsec-dynamic-rule(33)". Then, the log analysis device 201 writes "C" in the primary memo corresponding to the searched communication data in the extraction management table 800 (see FIGS. 14A and 14B). Note that if "B" has been written in the primary memo, the log analysis device 201 overwrites it with "C".

[0200] Moreover, the VLAN_ID is a value unique to each customer. Therefore, it can be said that the communication data including the "ipsec-dynamic-rule(33)" is the communication data of the corresponding customer. Therefore, the log analysis device 201 writes "ON" in the confirmation memo corresponding to the searched communication data in the extraction management table 800 (see FIGS. 14A and 14B).

[0201] For example, the communication data in the second line of the network log L4 includes "ipsec-dynamic-rule(33)." In this case, the log analysis device 201 writes "C" in the primary memo corresponding to line number "2" in the extraction management table 800, and writes "ON" in the final memo corresponding to line number "2" (see FIG. 14A).

[0202] Furthermore, the log analysis device 201 identifies the client IP address included in the communication data including the searched "ipsec-dynamic-rule(33)". For example, the communication data in the second line of the network log L4 includes the IP addresses "IpAdd153, IpAdd147". "IpAdd153" is the IP address of the network device 202. Therefore, the log analysis device 201 identifies "IpAdd147" as the client IP address. This client IP address can be said to be the IP address of the customer in question.

[0203] Next, the log analysis device 201 searches the network log L4 for communication data including the identified client IP address "IpAdd147". Then, the log analysis device 201 writes "D" in the primary memo corresponding to the searched communication data in the extraction management table 800 (see FIGS. 14A and 14B).

[0204] For example, the communication data in the first line of the network log L2 includes "IpAdd 147." In this case, the log analysis device 201 writes "D" in the primary memo corresponding to the line number "1" in the extraction management table 800 (see FIG. 14A).

[0205] Hereinafter, the communication data of the lines in which A, B, C, or D is written in the primary memo in the network log L4 will be searched for.

[0206] - IKE Phase 1 Negotiation Analysis Next, the log analysis device 201 searches the search target for communication data (first communication data) including the first protocol message "PHASE1 negotiation begins". Then, the log analysis device 201 writes "E" to the phase 1 memo corresponding to the searched communication data in the extraction management table 800 as the start of the negotiation (see FIGS. 14C and 14D).

[0207] For example, the communication data on the 8th line of the network log L4 includes "PHASE1 negotiation begins." In this case, the log analysis device 201 writes "E" to the phase 1 memo corresponding to the line number "8" in the extraction management table 800 (see FIG. 14C).

[0208] Next, the log analysis device 201 searches the search target for communication data (second communication data) including the second protocol message "ISAKMP-SA has been established." Then, the log analysis device 201 writes "F" to the phase 1 memo corresponding to the searched communication data in the extraction management table 800 as the end of the negotiation (see FIGS. 14C and 14D).

[0209] For example, the communication data on the 10th line of the network log L4 includes "ISAKMP-SA has been established." In this case, the log analysis device 201 writes "F" in the phase 1 memo corresponding to the line number "10" in the extraction management table 800 (see FIG. 14C).

[0210] Next, the log analysis device 201 judges whether or not "host0033" is included in the searched communication data (second communication data). For example, the communication data in the 10th line of the network log L4 includes "host0033".

[0211] Here, if "host0033" is included, then IKE phase 1 has been successfully established for the customer, and the client IP address in the lines between phase 1 memo "E" and phase 1 memo "F" can be identified as the IP address of the customer. Therefore, the log analysis device 201 writes "ON" in the confirmation memo corresponding to the communication data between phase 1 memo "E" and phase 1 memo "F" (see FIGS. 14C and 14D). However, blank lines are excluded.

[0212] For example, the communication data on the 33rd line of the network log L4 is a line included in the range from phase 1 memo "E" to phase 1 memo "F." In this case, the log analysis device 201 writes "ON" in the confirmation memo corresponding to the line number "33" in the extraction management table 800 (see FIG. 14D).

[0213] In addition, in lines 22 to 24 of network log L4, there is a range from Phase 1 memo "E" to Phase 1 memo "F". However, the communication data of Phase 1 memo "F" on line 24 does not include "host0033". Therefore, the confirmation memo for this range is not "ON".

[0214] - IKE Phase 2 Negotiation Analysis Next, the log analysis device 201 searches the search target for communication data (third communication data) including the third protocol message "PHASE2 negotiation begins". Then, the log analysis device 201 writes "G" as the start of negotiation in the phase 2 memo corresponding to the searched communication data in the extraction management table 800 (see FIGS. 14E and 14F).

[0215] For example, the communication data in the first line of the network log L4 includes "PHASE2 negotiation begins." In this case, the log analysis device 201 writes "G" in the phase 2 memo corresponding to the line number "1" in the extraction management table 800 (see FIG. 14E).

[0216] Next, the log analysis device 201 searches the search target for communication data (fourth communication data) including the fourth protocol message "IPsec-SA has been established: (INBOUND)". Then, the log analysis device 201 writes "H" to the phase 2 memo corresponding to the searched communication data in the extraction management table 800 as the end of the negotiation (see FIGS. 14E and 14F).

[0217] For example, the communication data in the third line of the network log L4 includes "IPsec-SA has been established: (INBOUND)". In this case, the log analysis device 201 writes "H" in the phase 2 memo corresponding to the line number "3" in the extraction management table 800 (see FIG. 14E).

[0218] Furthermore, the log analysis device 201 searches the search target for communication data (fifth communication data) including a fifth protocol message "IPsec-SA has been established: (OUTBOUND)". Then, the log analysis device 201 writes "I" to the phase 2 memo corresponding to the searched communication data in the extraction management table 800 as the end of the negotiation (see FIGS. 14E and 14F).

[0219] For example, the communication data on the fifth line of the network log L4 includes "IPsec-SA has been established: (OUTBOUND)". In this case, the log analysis device 201 writes "I" in the phase 2 memo corresponding to the line number "5" in the extraction management table 800 (see FIG. 14E).

[0220] Next, the log analysis device 201 determines whether the searched communication data (the fourth communication data and the fifth communication data) includes "ipsec-dynamic-rule(33)." For example, the communication data in the third and fifth lines of the network log L4 includes "ipsec-dynamic-rule(33)."

[0221] Here, if "ipsec-dynamic-rule(33)" is included, IKE phase 2 has been successfully established for the customer, and the client IP address in the lines between phase 2 memo "G" and phase 2 memo "I" (G~H~I) can be identified as the IP address of the customer. Therefore, the log analysis device 201 writes "ON" in the confirmation memo corresponding to the communication data between phase 2 memo "G" and phase 2 memo "I" (G~H~I) (see FIGS. 14E and 14F). However, blank lines are excluded.

[0222] For example, the communication data in the first line of the network log L4 is a line included in the range (G-H-I) from phase 2 memo "G" to phase 2 memo "I." In this case, the log analysis device 201 writes "ON" in the confirmation memo corresponding to the line number "1" in the extraction management table 800 (see FIG. 14E).

[0223] - Analysis of validity range based on cookie values Next, the log analysis device 201 searches the search target for a communication data group that includes the same cookie value. Then, the log analysis device 201 writes the "cookie ID" in the cookie memo corresponding to the searched communication data in the extraction management table 800 (see FIGS. 14G and 14H).

[0224] For example, the communication data on lines 9, 10, 14, 16, and 17 of the network log L4 contains the same cookie value "6278bc68d344f112." In this case, the log analysis device 201 writes "J" into the cookie memo corresponding to line numbers "9, 10, 14, 16, and 17" in the extraction management table 800 (see FIG. 14G).

[0225] Next, the log analysis device 201 determines whether the searched communication data group includes communication data containing "host0033". The client IP address of the communication data containing "host0033" is the IP address of the corresponding customer. For example, the communication data on the 9th line of the network log L4 includes "host0033". Therefore, it can be said that the client IP address "IpAdd186" of the communication data on the 9th line is the IP address of the corresponding customer.

[0226] Therefore, the log analysis device 201 writes "ON" in the confirmation memo corresponding to the communication data including the same IP address as the client IP address from the first communication data to the last communication data of the same cookie ID (see FIGS. 14G and 14H).

[0227] For example, the communication data on line 11 of network log L4 includes an IP address that is the same as the client IP address "IpAdd186" between the first communication data (line 9) and the last communication data (line 17) of cookie ID "J." In this case, the log analysis device 201 writes "ON" in the confirmation memo corresponding to line number "9" in the extraction management table 800 (see FIG. 14G).

[0228] In this way, it is possible to determine the communication data to be extracted from the network log L4. The log analysis device 201 refers to the extraction management table 800 shown in Figures 14G and 14H, and extracts the communication data of the confirmation memo "ON" from the network log L4, thereby extracting only the communication data of the relevant customer (customer A).

[0229] Additionally, the communication data on lines 22 to 31 of network log L4 is an example where a customer other than the customer in question temporarily used the same client IP address "IpAdd147." In this case, even though the communication data includes the same client IP address "IpAdd147," the confirmation memo is not set to ON, and the data is excluded from extraction.

[0230] (Log analysis process procedure of the log analysis device 201) Next, the log analysis process procedure of the log analysis device 201 will be described with reference to FIG.

[0231] Fig. 15 is a flowchart showing an example of a log analysis process procedure of the log analysis device 201. In the flowchart of Fig. 15, first, the log analysis device 201 determines whether or not extraction conditions have been accepted (step S1501). The extraction conditions include, for example, a customer ID, a customer name, and the like.

[0232] Here, the log analysis device 201 waits for the extraction conditions to be accepted (step S1501: No). If the extraction conditions are accepted (step S1501: Yes), the log analysis device 201 executes a primary extraction process (step S1502). A specific procedure of the primary extraction process will be described later with reference to FIGS. 16 to 19.

[0233] Then, the log analysis device 201 executes a first negotiation analysis process (step S1503). A specific procedure of the first negotiation analysis process will be described later with reference to FIGS.

[0234] Next, the log analysis device 201 executes a second negotiation analysis process (step S1504). A specific procedure of the second negotiation analysis process will be described later with reference to FIGS.

[0235] Then, the log analysis device 201 executes a cookie analysis process (step S1505). A specific procedure of the cookie analysis process will be described later with reference to FIGS.

[0236] Next, the log analysis device 201 refers to the extraction management table 800 and extracts communication data of the confirmation memo "ON" from the network log L (step S1506). Then, the log analysis device 201 outputs the log analysis result including the extracted communication data (step S1507) and ends the series of processes according to this flowchart.

[0237] This allows the log analysis device 201 to extract only the communication data of the relevant customer from the network log L. Note that the log analysis device 201 may not execute any of the processes in steps S1503 to S1505.

[0238] Next, a specific processing procedure of the primary extraction processing in step S1502 will be described with reference to FIGS.

[0239] 16 to 19 are flowcharts showing an example of a specific processing procedure of the primary extraction process. In the flowchart of Fig. 16, first, the log analysis device 201 refers to the customer information DB 220 and acquires the VLAN_ID corresponding to the customer ID etc. included in the accepted extraction condition (step S1601).

[0240] Next, the log analysis device 201 searches the network log L for a line (communication data) containing "host00xx" (step S1602), where xx corresponds to the VLAN_ID (the VLAN_ID of the relevant customer) acquired in step S1601. Then, the log analysis device 201 determines whether the line (communication data) is found (step S1603).

[0241] If the row (communication data) is not found (step S1603: No), the log analysis device 201 proceeds to step S1606. On the other hand, if the row (communication data) is found (step S1603: Yes), the log analysis device 201 writes "A" in the primary memo corresponding to the found row (communication data) in the extraction management table 800 (step S1604).

[0242] Then, the log analysis device 201 writes "ON" in the confirmation memo corresponding to the found row (communication data) in the extraction management table 800 (step S1605). Next, the log analysis device 201 determines whether or not all of the network log L has been searched (step S1606).

[0243] If the network log L has not been completely searched (step S1606: No), the log analysis device 201 returns to step S1602. On the other hand, if the network log L has been completely searched (step S1606: Yes), the log analysis device 201 proceeds to step S1701 shown in FIG.

[0244] 17, first, the log analysis device 201 identifies the client IP address of the line (communication data) in which "A" is written in the primary memo (step S1701). Then, the log analysis device 201 selects an unselected client IP address from among the identified client IP addresses (step S1702).

[0245] Next, the log analysis device 201 searches the network log L for a line (communication data) including the selected client IP address (step S1703). Then, the log analysis device 201 determines whether the line (communication data) is found (step S1704).

[0246] If the row (communication data) is not found (step S1704: No), the log analysis device 201 proceeds to step S1707. On the other hand, if the row (communication data) is found (step S1704: Yes), the log analysis device 201 determines whether "A" is written in the primary memo corresponding to the found row (communication data) in the extraction management table 800 (step S1705).

[0247] Here, if "A" is written in the primary memo (step S1705: Yes), the log analysis device 201 proceeds to step S1707. On the other hand, if "A" is not written in the primary memo (step S1705: No), the log analysis device 201 writes "B" in the primary memo corresponding to the found row (communication data) in the extraction management table 800 (step S1706).

[0248] Then, the log analysis device 201 judges whether or not all of the network logs L have been searched (step S1707). If all of the network logs L have not been searched (step S1707: No), the log analysis device 201 returns to step S1703.

[0249] On the other hand, if all of the network log L has been searched (step S1707: Yes), the log analysis device 201 determines whether or not there is an unselected client IP address among the identified client IP addresses (step S1708).

[0250] If there is an unselected client IP address (step S1708: Yes), the log analysis device 201 returns to step S1702. On the other hand, if there is no unselected client IP address (step S1708: No), the log analysis device 201 proceeds to step S1801 shown in FIG.

[0251] 18, first, the log analysis device 201 searches the network log L for a line (communication data) including "ipsec-dynamic-rule(xx)" (step S1801). Then, the log analysis device 201 determines whether the line (communication data) is found (step S1802).

[0252] If the row (communication data) is not found (step S1802: No), the log analysis device 201 proceeds to step S1805. On the other hand, if the row (communication data) is found (step S1802: Yes), the log analysis device 201 writes "C" in the primary memo corresponding to the found row (communication data) in the extraction management table 800 (step S1803). Note that if "B" has been written in the primary memo, the log analysis device 201 overwrites it with "C".

[0253] Next, the log analysis device 201 writes "OK" in the confirmation memo corresponding to the found row (communication data) in the extraction management table 800 (step S1804). Then, the log analysis device 201 determines whether or not all of the network log L has been searched (step S1805).

[0254] If the network log L has not been completely searched (step S1805: No), the log analysis device 201 returns to step S1801. On the other hand, if the network log L has been completely searched (step S1805: Yes), the log analysis device 201 proceeds to step S1901 shown in FIG.

[0255] 19, first, the log analysis device 201 identifies the client IP address of the line (communication data) with "C" written in the primary memo (step S1901). Then, the log analysis device 201 selects an unselected client IP address from among the identified client IP addresses (step S1902).

[0256] Next, the log analysis device 201 searches the network log L for a line (communication data) including the selected client IP address (step S1903). Then, the log analysis device 201 determines whether the line (communication data) is found (step S1904).

[0257] If the row (communication data) is not found (step S1904: No), the log analysis device 201 proceeds to step S1907. On the other hand, if the row (communication data) is found (step S1904: Yes), the log analysis device 201 determines whether "C" is written in the primary memo corresponding to the found row (communication data) in the extraction management table 800 (step S1905).

[0258] If "C" is written in the primary memo (step S1905: Yes), the log analysis device 201 proceeds to step S1907. On the other hand, if "C" is not written in the primary memo (step S1905: No), the log analysis device 201 writes "D" in the primary memo corresponding to the found row (communication data) in the extraction management table 800 (step S1906).

[0259] Then, the log analysis device 201 judges whether or not all of the network logs L have been searched (step S1907). If all of the network logs L have not been searched (step S1907: No), the log analysis device 201 returns to step S1903.

[0260] On the other hand, if all of the network logs L have been searched (step S1907: Yes), the log analysis device 201 determines whether or not there is an unselected client IP address among the identified client IP addresses (step S1908).

[0261] If there is an unselected client IP address (step S1908: Yes), the log analysis device 201 returns to step S1902. On the other hand, if there is no unselected client IP address (step S1908: No), the log analysis device 201 returns to the step that called the primary extraction process.

[0262] This allows the log analysis device 201 to determine the communication data to be extracted (communication data with the confirmation memo "ON") using the host name and protocol message including the VLAN_ID of the customer as a clue. Also, the log analysis device 201 can search for communication data including the same IP address as the client IP address of the customer as a candidate for the communication data of the customer.

[0263] Next, a specific procedure of the first negotiation analysis process in step S1503 will be described with reference to FIGS.

[0264] 20 and 21 are flowcharts showing an example of a specific processing procedure of the first negotiation analysis process. In the flowchart of Fig. 20, first, the log analysis device 201 searches for lines (communication data) in which A, B, C, and D are written in the primary memo in the network log L (step S2001).

[0265] Next, the log analysis device 201 searches the search target for a line (communication data) containing "PHASE1 negotiation begins" (step S2002). Then, the log analysis device 201 determines whether the line (communication data) is found (step S2003).

[0266] If the row (communication data) is not found (step S2003: No), the log analysis device 201 proceeds to step S2005. On the other hand, if the row (communication data) is found (step S2003: Yes), the log analysis device 201 writes "E" in the phase 1 memo corresponding to the found row (communication data) in the extraction management table 800 (step S2004).

[0267] Then, the log analysis device 201 judges whether or not all the search targets have been searched (step S2005). If all the search targets have not been searched (step S2005: No), the log analysis device 201 returns to step S2002.

[0268] On the other hand, if all the search targets have been searched (step S2005: Yes), the log analysis device 201 searches the search targets for a line (communication data) containing "ISAKMP-SA has been established" (step S2006). Then, the log analysis device 201 determines whether the line (communication data) is found (step S2007).

[0269] If the row (communication data) is not found (step S2007: No), the log analysis device 201 proceeds to step S2009. On the other hand, if the row (communication data) is found (step S2007: Yes), the log analysis device 201 writes "F" in the phase 1 memo corresponding to the found row (communication data) in the extraction management table 800 (step S2008).

[0270] Then, the log analysis device 201 judges whether or not all the search targets have been searched (step S2009). If all the search targets have not been searched (step S2009: No), the log analysis device 201 returns to step S2006. On the other hand, if all the search targets have been searched (step S2009: Yes), the log analysis device 201 proceeds to step S2101 shown in FIG.

[0271] 21, first, the log analysis device 201 identifies the hostxx in the line with "F" written in the phase 1 memo (step S2101). Then, the log analysis device 201 determines whether the identified hostxx is the same as the customer (step S2102).

[0272] Note that hostxx being the same as that of the relevant customer means that the xx portion is the same as the VLAN_ID of the relevant customer (the VLAN_ID acquired in step S1602 shown in FIG. 16).

[0273] If the customer is different from the relevant customer (step S2102: No), the log analysis device 201 returns to the step where the first negotiation analysis process was called. On the other hand, if the customer is the same as the relevant customer (step S2102: Yes), the log analysis device 201 writes "ON" in the confirmation memo of each line from the line with "E" written in the Phase 1 memo to the line with "F" written in the extraction management table 800 (step S2103), and returns to the step where the first negotiation analysis process was called.

[0274] As a result, the log analysis device 201 can determine the communication data to be extracted (communication data with the confirmation memo "ON") by utilizing the range in which the IKE phase 1 negotiation communication was performed by the relevant customer.

[0275] Next, a specific procedure of the second negotiation analysis process in step S1504 will be described with reference to FIGS.

[0276] 22 and 23 are flowcharts showing an example of a specific processing procedure of the second negotiation analysis processing. In the flowchart of Fig. 22, first, the log analysis device 201 searches the search target for a line (communication data) including "PHASE2 negotiation begins" (step S2201).

[0277] Then, the log analysis device 201 judges whether or not the row (communication data) is found (step S2202). If the row (communication data) is not found (step S2202: No), the log analysis device 201 proceeds to step S2204.

[0278] On the other hand, if the row (communication data) is found (step S2202: Yes), the log analysis device 201 writes "G" in the phase 2 memo corresponding to the found row (communication data) in the extraction management table 800 (step S2203). Then, the log analysis device 201 determines whether all search targets have been searched (step S2204).

[0279] If all the search targets have not been searched (step S2204: No), the log analysis device 201 returns to step S2201. On the other hand, if all the search targets have been searched (step S2204: Yes), the log analysis device 201 searches the search targets for a line (communication data) containing "IPsec-SA has been established: (INBOUND)" (step S2205).

[0280] Then, the log analysis device 201 judges whether or not the row (communication data) is found (step S2206). If the row (communication data) is not found (step S2206: No), the log analysis device 201 proceeds to step S2208.

[0281] On the other hand, if the row (communication data) is found (step S2206: Yes), the log analysis device 201 writes "H" in the phase 2 memo corresponding to the found row (communication data) in the extraction management table 800 (step S2207).

[0282] Then, the log analysis device 201 judges whether or not all search targets have been searched (step S2208). If all search targets have not been searched (step S2208: No), the log analysis device 201 returns to step S2205. On the other hand, if all search targets have been searched (step S2208: Yes), the log analysis device 201 proceeds to step S2301 shown in FIG.

[0283] In the flowchart of FIG. 23, first, the log analysis device 201 searches the search target for a line (communication data) containing "IPsec-SA has been established: (OUTBOUND)" (step S2301).

[0284] Then, the log analysis device 201 judges whether or not the row (communication data) is found (step S2302). If the row (communication data) is not found (step S2302: No), the log analysis device 201 proceeds to step S2304.

[0285] On the other hand, if the row (communication data) is found (step S2302: Yes), the log analysis device 201 writes "I" in the phase 2 memo corresponding to the found row (communication data) in the extraction management table 800 (step S2303). Then, the log analysis device 201 determines whether or not all search targets have been searched (step S2304).

[0286] If all search targets have not been searched (step S2304: No), the log analysis device 201 returns to step S2301. On the other hand, if all search targets have been searched (step S2304: Yes), the log analysis device 201 identifies the ipsec-dynamic-rule(xx) of the row (communication data) in which "H" or "I" is written in the phase 2 memo in the extraction management table 800 (step S2305).

[0287] Then, the log analysis device 201 judges whether the specified ipsec-dynamic-rule(xx) is the same as that of the corresponding customer (step S2306). Note that the ipsec-dynamic-rule(xx) being the same as that of the corresponding customer means that the xx portion is the same as the VLAN_ID of the corresponding customer (the VLAN_ID acquired in step S1602 shown in FIG. 16).

[0288] If the customer is different from the relevant customer (step S2306: No), the log analysis device 201 returns to the step where the second negotiation analysis process was called. On the other hand, if the customer is the same as the relevant customer (step S2306: Yes), the log analysis device 201 writes "ON" in the confirmation memo of each line in the extraction management table 800 from the line where "G" is written in the phase 2 memo to the line where "H" or "I", whichever appears later, is written (step S2307), and returns to the step where the second negotiation analysis process was called.

[0289] As a result, the log analysis device 201 can determine the communication data to be extracted (communication data with the confirmation memo "ON") by utilizing the range in which the IKE phase 2 negotiation communication was performed by the relevant customer.

[0290] Next, a specific procedure for the cookie analysis process in step S1505 will be described with reference to FIGS.

[0291] 24 and 25 are flowcharts showing an example of a specific processing procedure of the cookie analysis process. In the flowchart of FIG. 24, the log analysis device 201 first searches the search target for a line (communication data) including a cookie value (step S2401). Then, the log analysis device 201 determines whether the line (communication data) is found (step S2402).

[0292] If the row (communication data) is not found (step S2402: No), the log analysis device 201 returns to the step that called the cookie analysis process. On the other hand, if the row (communication data) is found (step S2402: Yes), the log analysis device 201 writes the "cookie ID" in the cookie memo corresponding to the found row (communication data) in the extraction management table 800 (step S2403).

[0293] Next, the log analysis device 201 searches the search target for a row (communication data) that includes the same cookie value (step S2404). Then, the log analysis device 201 determines whether the row (communication data) is found (step S2405). If the row (communication data) is not found (step S2405: No), the log analysis device 201 proceeds to step S2407.

[0294] On the other hand, if the row (communication data) is found (step S2405: Yes), the log analysis device 201 writes "the same cookie ID" to the cookie memo corresponding to the found row (communication data) in the extraction management table 800 (step S2406). The same cookie ID is the same cookie ID as the cookie ID written in step S2403.

[0295] Then, the log analysis device 201 judges whether or not all search targets have been searched (step S2407). If all search targets have not been searched (step S2407: No), the log analysis device 201 returns to step S2404. On the other hand, if all search targets have been searched (step S2407: Yes), the log analysis device 201 proceeds to step S2501 shown in FIG.

[0296] 25, first, the log analysis device 201 identifies the hostxx of the row (communication data) in which the "cookie ID" is written in the cookie memo in the extraction management table 800 (step S2501). The cookie ID is the cookie ID written in step S2403.

[0297] Then, the log analysis device 201 judges whether the identified hostxx is the same as the corresponding customer (step S2502). If the identified hostxx is different from the corresponding customer (step S2502: No), the log analysis device 201 proceeds to step S2505.

[0298] On the other hand, if the customer is the same as the customer (step S2502: Yes), the log analysis device 201 identifies the section from the beginning to the end of the line in which the "cookie ID" is written in the cookie memo in the extraction management table 800 (step S2503). Then, the log analysis device 201 writes "ON" in the confirmation memo of the line (communication data) that includes the same client IP address as the customer in the identified section (step S2504).

[0299] Then, the log analysis device 201 judges whether or not all search targets have been searched (step S2505). If all search targets have not been searched (step S2505: No), the log analysis device 201 returns to step S2401 shown in Fig. 24. On the other hand, if all search targets have been searched (step S2505: Yes), the log analysis device 201 returns to the step that called the cookie analysis process.

[0300] This allows the log analysis device 201 to determine the communication data to be extracted (communication data with the confirmation memo "ON") by utilizing the range of the session managed by the cookie value that identifies the relevant customer.

[0301] As described above, the log analysis device 201 according to the embodiment can acquire the VLAN_ID of the relevant customer, and identify the client IP address included in the communication data including the acquired VLAN_ID of the relevant customer from the network log L. Furthermore, the log analysis device 201 can search for candidate communication data including the identified client IP address from the network log L, and search for encrypted communication establishment information from the network log L. Furthermore, when the searched encrypted communication establishment information is related to the VLAN_ID of the relevant customer, the log analysis device 201 can determine communication data to be extracted from the searched candidate communication data based on the encrypted communication establishment information. Then, the log analysis device 201 can extract the determined communication data to be extracted from the network log L, and output the extracted communication data.

[0302] As a result, the log analysis device 201 can use information that identifies the establishment of encrypted communication for the relevant customer to accurately extract the communication data of the relevant customer from the candidate communication data that includes the same IP address as the client IP address of the relevant customer. For example, by using the range of communication in which information for performing encrypted communication by the relevant customer is exchanged, it is possible to determine that the communication data is that of the relevant customer, thereby preventing erroneous extraction.

[0303] In addition, according to the log analysis device 201, cookie-related information can be searched for from the network log L, and if the searched cookie-related information is related to the VLAN_ID of the customer in question, the communication data to be extracted can be determined from the searched candidate communication data based on the cookie-related information.

[0304] As a result, the log analysis device 201 can use the information managing the sessions of the customer to accurately extract the communication data of the customer from the candidate communication data including the same IP address as the client IP address of the customer.

[0305] Furthermore, according to the log analysis device 201, it is possible to search for the first communication data and the second communication data from the network log L. The first communication data includes a protocol message indicating the start of the negotiation communication of IKE phase 1. The second communication data includes a protocol message indicating the end of the negotiation communication of IKE phase 1. Then, according to the log analysis device 201, when the searched second communication data includes the VLAN_ID of the corresponding customer (for example, a host name including the VLAN_ID of the corresponding customer), it is possible to determine, from among the searched candidate communication data, the candidate communication data included in a first time range from the first communication data to the second communication data as the communication data to be extracted.

[0306] This allows the log analysis device 201 to accurately extract the communication data of the relevant customer from the candidate communication data by utilizing the range in which the IKE phase 1 negotiation communication by the relevant customer was performed.

[0307] Moreover, according to the log analysis device 201, the third communication data, the fourth communication data, and the fifth communication data can be searched from the network log L. The third communication data includes a protocol message indicating the start of the negotiation communication of IKE phase 2. The fourth communication data includes a protocol message indicating the end of the negotiation communication in the receiving direction of IKE phase 2. The fifth communication data includes a protocol message indicating the end of the negotiation communication in the transmitting direction of IKE phase 2. Then, according to the log analysis device 201, when the fourth communication data and the fifth communication data include the VLAN_ID of the corresponding customer (for example, a protocol message including the VLAN_ID of the corresponding customer), the candidate communication data included in the second time range from the third communication data to the communication data with the latest recording time among the fourth communication data and the fifth communication data can be determined as the communication data to be extracted.

[0308] This allows the log analysis device 201 to accurately extract the communication data of the relevant customer from the candidate communication data by utilizing the range in which the IKE phase 2 negotiation communication by the relevant customer was performed.

[0309] Furthermore, according to the log analysis device 201, the network log L is searched for communication data groups containing the same cookie value, and if the searched communication data group contains communication data containing the VLAN_ID of the relevant customer (e.g., a host name containing the VLAN_ID of the relevant customer), the candidate communication data among the searched candidate communication data that is included in a third time range from the first communication data to the last communication data of the communication data group can be determined as the communication data to be extracted.

[0310] This allows the log analysis device 201 to accurately extract the communication data of the relevant customer from the candidate communication data by utilizing the session range managed by the cookie value that identifies the relevant customer.

[0311] Furthermore, the log analysis device 201 can determine the communication data including the acquired VLAN_ID of the customer as the communication data to be extracted.

[0312] This allows the log analysis device 201 to extract the communication data of the customer with high accuracy using the VLAN_ID of the customer as a clue.

[0313] Furthermore, the log analysis device 201 can search the network log L for communication data that includes a host name that includes the VLAN_ID of the customer, and identify the client IP address included in the searched communication data.

[0314] This allows the log analysis device 201 to identify the client IP address of the customer using the host name as a clue.

[0315] In addition, according to the log analysis device 201, it is possible to search the network log L for communication data that includes a protocol message that includes the VLAN_ID of the customer in question, and to identify the client IP address included in the searched communication data.

[0316] This allows the log analysis device 201 to identify the client's client IP address using a protocol message (for example, a message that identifies the protocol of encrypted communication) as a clue.

[0317] From these facts, the log analysis device 201 according to the embodiment can prevent omissions when extracting communication data of a specific user (e.g., a customer) from the network log L including communication data of multiple users. For example, an operator only needs to specify information of the customer (e.g., a customer ID, a customer name, etc.) as an extraction condition, and extraction based on multiple condition layers and effective range extraction taking into account protocols are performed, making it possible to extract necessary information without omissions.

[0318] The data extraction method described in this embodiment can be realized by executing a prepared program on a computer such as a personal computer or a workstation. The data extraction program is recorded on a computer-readable recording medium such as a hard disk, a flexible disk, a CD-ROM, a DVD, or a USB memory, and is executed by being read from the recording medium by the computer. The data extraction program may also be distributed via a network such as the Internet.

[0319] In addition, the log analysis device 201 (information processing device 101) described in this embodiment can also be realized by an application-specific IC such as a standard cell or a structured ASIC (Application Specific Integrated Circuit) or a PLD (Programmable Logic Device) such as an FPGA.

[0320] The following supplementary notes are further disclosed regarding the above-described embodiment.

[0321] (Appendix 1) Obtain an identifier that identifies a network corresponding to a specific user, Identifying an IP address corresponding to the specific user, which is included in communication data including the acquired identifier, from a network log including a plurality of communication data; Searching the network log for communication data including the identified IP address; Searching for at least one of encrypted communication establishment information and cookie-related information from the network log; determining communication data to be extracted from the retrieved communication data based on the information if the retrieved information relates to the identifier; A data extraction program that causes a computer to execute a process.

[0322] (Supplementary Note 2) The encrypted communication establishment information includes a protocol message indicating a start of IKE phase 1 negotiation communication and a protocol message indicating an end of the IKE phase 1 negotiation communication, The searching process includes: searching the network log for first communication data including a protocol message indicating a start of the IKE phase 1 negotiation communication and second communication data including a protocol message indicating an end of the IKE phase 1 negotiation communication; The process of determining includes: When the searched second communication data includes the identifier, among the searched communication data, communication data included in a first time range from the first communication data to the second communication data is determined as the communication data to be extracted. 2. The data extraction program according to claim 1, characterized in that the program causes the computer to execute a process.

[0323] (Supplementary Note 3) The encrypted communication establishment information includes a protocol message indicating a start of IKE phase 2 negotiation communication, a protocol message indicating an end of the IKE phase 2 negotiation communication in the receiving direction, and a protocol message indicating an end of the IKE phase 2 negotiation communication in the transmitting direction, The searching process includes: searching, from the network log, for third communication data including a protocol message indicating a start of the IKE phase 2 negotiation communication, fourth communication data including a protocol message indicating an end of the IKE phase 2 negotiation communication in the receiving direction, and fifth communication data including a protocol message indicating an end of the IKE phase 2 negotiation communication in the transmitting direction; The process of determining includes: When the identifier is included in the searched fourth communication data and the fifth communication data, the communication data included in a second time range from the third communication data to the communication data having the latest recording time among the fourth communication data and the fifth communication data is determined as the communication data to be extracted. 3. The data extraction program according to claim 1 or 2, characterized in that the program causes the computer to execute the process.

[0324] (Appendix 4) Search for the cookie-related information, including the cookie value; The searching process includes: A search is made for a communication data group including the same cookie value from the network log; The process of determining includes: When the searched communication data group includes communication data including the identifier, among the searched communication data, communication data included in a third time range from the first communication data to the last communication data of the communication data group is determined to be the communication data to be extracted. 4. The data extraction program according to any one of claims 1 to 3, which causes the computer to execute a process.

[0325] (Appendix 5) The communication data including the acquired identifier is determined to be the communication data to be extracted. 5. The data extraction program according to any one of claims 1 to 4, which causes the computer to execute a process.

[0326] (Appendix 6) Extracting the determined communication data to be extracted from the network log; outputting the extracted communication data; 6. The data extraction program according to any one of claims 1 to 5, which causes the computer to execute a process.

[0327] (Supplementary Note 7) The data extraction program according to any one of Supplementary Notes 1 to 6, wherein the network is a VLAN.

[0328] (Supplementary Note 8) The data extraction program according to any one of Supplementary Notes 1 to 7, wherein the communication data including the identifier is communication data including a host name including the identifier.

[0329] (Supplementary Note 9) The data extraction program according to any one of Supplementary Notes 1 to 8, wherein the communication data including the identifier is communication data including a protocol message including the identifier.

[0330] (Appendix 10) The process of determining The data extraction program described in Appendix 2, characterized in that if the second communication data includes a host name including the identifier, the communication data included in the first time range from among the searched communication data is determined to be the communication data to be extracted.

[0331] (Appendix 11) The process of determining The data extraction program of claim 3, characterized in that when the fourth communication data and the fifth communication data include a protocol message including the identifier, the communication data included in the second time range among the searched communication data is determined to be the communication data to be extracted.

[0332] (Appendix 12) The process of determining The data extraction program according to claim 4, characterized in that, when the group of communication data includes communication data containing a host name including the identifier, the communication data included in the third time range among the searched communication data is determined to be the communication data to be extracted.

[0333] (Appendix 13) Obtain an identifier that identifies a network corresponding to a specific user, Identifying an IP address corresponding to the specific user, which is included in communication data including the acquired identifier, from a network log including a plurality of communication data; Searching the network log for communication data including the identified IP address; Searching for at least one of encrypted communication establishment information and cookie-related information from the network log; determining communication data to be extracted from the retrieved communication data based on the information if the retrieved information relates to the identifier; A data extraction method characterized in that the processing is executed by a computer.

[0334] (Appendix 14) Obtain an identifier that identifies a network corresponding to a specific user, Identifying an IP address corresponding to the specific user, which is included in communication data including the acquired identifier, from a network log including a plurality of communication data; Searching the network log for communication data including the identified IP address; Searching for at least one of encrypted communication establishment information and cookie-related information from the network log; determining communication data to be extracted from the retrieved communication data based on the information if the retrieved information relates to the identifier; An information processing device comprising a control unit for executing processing. [Explanation of symbols]

[0335] 101 Information processing device 110,L,L1,L2,L3,L4 Network Log 111,112,113,114 Communication data 115 First communication data 116 Second communication data 200 Information Processing Systems 201 Log analysis device 202 Network equipment 203 Customer Server 204 Client terminal 210 Network 220 Customer information DB 300 Bus 301 CPU 302 Memory 303 Disk Drive 304 Disk 305 Communication I / F 306 Portable Recording Media I / F 307 Portable recording media 601 Reception 602 Acquisition Department 603 Collection Department 604 Analysis Department 605 Output section 611 Specific part 612 First Search Section 613 Second Search Section 614 Third Search Section 615 Extraction part 700 Log analysis results 800 Extraction Management Table

Claims

1. Obtaining an identifier for identifying a network corresponding to a particular user; Identifying an IP address corresponding to the specific user, which is included in communication data including the acquired identifier, from a network log including a plurality of communication data; Searching the network log for communication data including the identified IP address; Searching for at least one of encrypted communication establishment information and cookie-related information from the network log; determining communication data to be extracted from the retrieved communication data based on the information if the retrieved information relates to the identifier; A data extraction program that causes a computer to execute a process.

2. the encrypted communication establishment information includes a protocol message indicating a start of IKE phase 1 negotiation communication and a protocol message indicating an end of the IKE phase 1 negotiation communication; The searching process includes: searching the network log for first communication data including a protocol message indicating a start of the IKE phase 1 negotiation communication and second communication data including a protocol message indicating an end of the IKE phase 1 negotiation communication; The process of determining includes: When the searched second communication data includes the identifier, among the searched communication data, communication data included in a first time range from the first communication data to the second communication data is determined as the communication data to be extracted.

2. The data extraction program according to claim 1, wherein the program causes the computer to execute a process.

3. the encrypted communication establishment information includes a protocol message indicating a start of IKE phase 2 negotiation communication, a protocol message indicating an end of the IKE phase 2 negotiation communication in the receiving direction, and a protocol message indicating an end of the IKE phase 2 negotiation communication in the transmitting direction, The searching process includes: searching, from the network log, for third communication data including a protocol message indicating a start of the IKE phase 2 negotiation communication, fourth communication data including a protocol message indicating an end of the IKE phase 2 negotiation communication in the receiving direction, and fifth communication data including a protocol message indicating an end of the IKE phase 2 negotiation communication in the transmitting direction; The process of determining includes: When the identifier is included in the searched fourth communication data and the searched fifth communication data, communication data included in a second time range from the third communication data to the communication data having the latest recording time among the fourth communication data and the fifth communication data is determined as the communication data to be extracted.

3. The data extraction program according to claim 1, wherein the program causes the computer to execute a process.

4. Retrieving the cookie-related information, including the cookie value; The searching process includes: A search is made for a communication data group including the same cookie value from the network log; The process of determining includes: When the searched communication data group includes communication data including the identifier, the communication data included in a third time range from the first communication data to the last communication data of the searched communication data group is determined to be the communication data to be extracted.

4. The data extraction program according to claim 1, which causes the computer to execute a process.

5. determining communication data including the acquired identifier as the communication data to be extracted; 5. The data extraction program according to claim 1, which causes the computer to execute a process.

6. extracting the determined communication data to be extracted from the network log; outputting the extracted communication data; 6. The data extraction program according to claim 1, which causes the computer to execute a process.

7. Obtaining an identifier for identifying a network corresponding to a particular user; Identifying an IP address corresponding to the specific user, which is included in communication data including the acquired identifier, from a network log including a plurality of communication data; Searching the network log for communication data including the identified IP address; Searching for at least one of encrypted communication establishment information and cookie-related information from the network log; determining communication data to be extracted from the retrieved communication data based on the information if the retrieved information relates to the identifier; A data extraction method characterized in that the processing is executed by a computer.

8. Obtaining an identifier for identifying a network corresponding to a particular user; Identifying an IP address corresponding to the specific user, which is included in communication data including the acquired identifier, from a network log including a plurality of communication data; Searching the network log for communication data including the identified IP address; Searching for at least one of encrypted communication establishment information and cookie-related information from the network log; determining communication data to be extracted from the retrieved communication data based on the information if the retrieved information relates to the identifier; An information processing device comprising a control unit for executing processing.

Images