摘要 |
A relay apparatus log analysis apparatus 132 periodically receives log data from a relay apparatus 112, when detecting a traffic abnormality, an abnormality detection apparatus 131 notifies the IP address of a terminal device that has caused the abnormality to the relay apparatus log analysis apparatus 132, the relay apparatus log analysis apparatus 132 analyzes traffic information generated by a router apparatus 121 to identify a time when the traffic abnormality has occurred, the relay apparatus log analysis apparatus 132 analyzes the log data, based on the occurrence time of the traffic abnormality and the IP address of the terminal device that has caused the abnormality, identifies an address accessed by the terminal device, regards the identified address as the destination from the malware, and sets the relay apparatus 112 so as to block a packet to the address. |