TRAFFIC SENSOR, ANALYSIS METHOD, AND ANALYSIS PROGRAM

This sensor calculates the degree of spread of the range of normal communication for each normal communication model of an IoT device. The sensor next classifies a normal communication model having a degree of spread that is below a prescribed threshold value as the normal communication model of a stable machine type, and classifies a normal communication model having a degree of spread that is greater than or equal to the prescribed threshold value as a normal communication model of an unstable-machine-type IoT device. The sensor then detects abnormal communication in a stable-machine-type IoT device using the normal communication model of the stable-machine-type IoT device, and reconstructs the normal communication model of the unstable-machine-type IoT device using a feature amount in which the contribution to detection of abnormal communication is greater than or equal to a prescribed value, among feature amounts used for the normal communication model. The sensor analyzes the abnormal communication common to each of the IoT devices by using the abnormal communication of the stable-machine-type IoT device detected using the normal communication model and the abnormal communication of the unstable-machine-type IoT device detected using the reconstructed normal communication model.