The disclosure relates to an analysis device configured to communicate with at least one node of an infrastructure of a distributed database via the communication interface in order to obtain authorization to detect intrusion of a computer system. The analysis device is also configured to detect, depending on whether the authorization is obtained, intrusion of the computer system based on an analysis of log messages of the computer system.