Device estimation device, device estimation method, and device estimation program

A device estimating apparatus acquires one or more DNS queries transmitted from each device connected to a network and generates comparison source data in which each content of the acquired DNS queries is associated with one or more pieces of attribute information of each of the one or more devices that have transmitted the DNS queries having the content. Thereafter, when one or more DNS queries are acquired from an estimation target device, the device estimating apparatus reads, for each DNS query, attribute information of one or more devices associated with a content of the DNS query from the comparison source data and estimates an attribute of the estimation target device using the read attribute information.