We Claim:
[Claim 1)
A process search apparats comprising:
a storage unit to store an activity process list in which an attack type identifer of a tye of a detected attack and an activity process identifer of an activity process perfred during a time period during which the attack is detected are associated with each other; and an operation process list in which an operation-source process identifer of an operation-source process having operated another process during the time period during which the attack is detected and an operation-destination process identifer of an operation-destination process that is the another process operated are associated with each other; and
an indirect process searching unit to search fr a set of indirect process identifers using the activity process list and the operation process list, the set of indirect process identifers corresponding to a set of activity process identifers associated with different attack tye identifers, and corresponding to a set of an operation-source process identifer and an operation-destination process identifer.
[Claim 2)
The process search apparatus according to claim 1, wherein the indirect process searching unit:
selects an origin type identifer fom attack type identifers included in the activity process list, based on a number of activity process identifers associated with each of the attack type identifers, the origin tye identifer being an attack tye identifier serving as an origin of a search; and
searches fr the set of indirect process identifers using activity process

identifiers associated with the selected origin type identifier.
[Claim 3]
The process search apparatus according to claim 2, wherein the indirect process searching unit selects, as the origin type identifier, an attack type identifier with a smallest number of activity process identifiers associated with the attack type identifier among the attack type identifiers included in the activity process list.
[Claim 4]
The process search apparatus according to claim 2, wherein the indirect process searching unit:
selects an activity process identifier associated with the origin type identifier, as an origin process identifier from the activity process list;
selects an attack type identifier different from the origin type identifier, as a search type identifier from the activity process list;
selects an activity process identifier associated with the search type identifier, as a search process identifier from the activity process list; and
determines whether the operation process list includes a set of an operation-destination process identifier and an operation-source process identifier corresponding to a set of the origin process identifier and the search process identifier.
[Claim 5]
The process search apparatus according to claim 4, wherein
the attack type identifier is a number indicating order of attacks, and
the indirect process searching unit selects, as the search type identifier, an

attack type identifier indicating a number immediately before a number indicated by the origin type identifier.
[Claim 6]
The process search apparatus according to claim 5, wherein when the operation process list includes a set of an operation-destination process identifier and an operation-source process identifier corresponding to a set of the origin process identifier and the search process identifier, and the number indicated by the search type identifier is a first number, the indirect process searching unit generates the set of the origin 1 process identifier and the search process identifier as the set of indirect process identifiers.
[Claim 7]
The process search apparatus according to claim 6, wherein
when the operation process list includes the set of an operation-destination process identifier and an operation-source process identifier corresponding to the set of the origin process identifier and the search process identifier, but the number indicated by the search type identifier is not the first number, the indirect process searching unit:
selects an activity process identifier associated with the search type identifier, i as a new origin process identifier;
selects an attack type identifier indicating a number immediately before the number indicated by the search type identifier, as a new search type identifier;
selects an activity process identifier associated with the new search type identifier, as a new search process identifier; and
generates, when the operation process list includes a set of an

operation-destination process identifier and an operation-source process identifier corresponding to a set of the new origin process identifier and the new search process identifier and the number indicated by the new search type identifier is the first number, the set of the origin process identifier and the search process identifier and the set of the new origin process identifier and the new search process identifier, as the set of indirect process identifiers.
[Claim 8]
The process search apparatus according to claim 5, wherein
the activity process list includes an attack start time that is a start time of the
time period during which an attack is detected, and that is a time associated with an
attack type identifier and an activity process identifier, and
the indirect process searching unit selects each activity process identifier
associated with the search type identifier, as the search process identifier, in ascending
order of attack start times from the activity process list.
[Claim 9]
The process search apparatus according to claim 8, wherein
the indirect process searching unit:
selects an operation-source process identifier identical to the search process identifier from the operation process list, and obtains an operation-destination process identifier associated with the selected operation-source process identifier, as an additional-process identifier from the operation process list; and
generates a set of the origin process identifier, the search process identifier, and the additional-process identifier as the set of indirect process identifiers when the

operation process list includes the set of an operation-destination process identifier and an operation-source process identifier corresponding to the set of the origin process identifier and the search process identifier, and the number indicated by the search type identifier is a first number.
[Claim 10]
The process search apparatus according to claim 9, wherein when the search process identifier is identical to an additional-process identifier for a search process identifier selected previously, the indirect process searching unit omits a processing for the set of the origin process identifier and the search process identifier.
[Claim 11]
The process search apparatus according to claim 6, wherein the indirect process searching unit:
selects an attack type identifier indicating a number immediately after the number indicated by the origin type identifier, as a new search type identifier;
selects an activity process identifier associated with the new search type identifier, as a new search process identifier; and
generates, when the operation process list includes a set of an operation-destination process identifier and an operation-source process identifier corresponding to a set of the origin process identifier and the new search process identifier, the set of the origin process identifier and the new search process identifier as the set of indirect process identifiers.
[Claim 12]

The process search apparatus according to claim 11, wherein
the activity process list includes an attack start time that is a start time of the
time period during which the attack is detected, and that is a time associated with the
attack type identifier and the activity process identifier, and
the indirect process searching unit selects each activity process identifier
associated with the search type identifier, as the new search process identifier, in
descending order of attack start times from the activity process list.
[Claim 13]
The process search apparatus according to claim 12, wherein
the indirect process searching unit:
selects an operation-source process identifier identical to the new search process identifier from the operation process list, and obtains an operation-source process identifier associated with the selected operation-source process identifier, as an additional-process identifier from the operation process list; and
adds the obtained additional-process identifier to the set of the origin process identifier and the search process identifier.
[Claim 14]
The process search apparatus according to claim 13, wherein when the new search process identifier is an identifier identical to an additional-process identifier for a search process identifier selected previously, the indirect process searching unit omits a processing for the set of the origin process identifier and the new search process identifier.

[Claim 15]
A process search program using an activity process list and an operation process list, wherein
the activity process list is a list in which an attack type identifier of a type of a detected attack and an activity process identifier of an activity process performed during a time period during which the attack is detected are associated with each other,
the operation process list is a list in which an operation-source process identifier of an operation-source process having operated another process during the time period during which the attack is detected and an operation-destination process identifier of an operation-destination process that is the another process operated are associated with each other, and
the process search program causes a computer to perform an indirect process search processing for searching for a set of indirect process identifiers using the activity process list and the operation process list, the set of indirect process identifiers corresponding to a set of activity process identifiers associated with different attack type identifiers, and corresponding to a set of an operation-source process identifier and an operation-destination process identifier.