ANALYSIS DEVICE, ANALYSIS SYSTEM, ANALYSIS METHOD, AND ANALYSIS PROGRAM

An analysis device includes processing circuitry configured to acquire, from each network traffic sensor that monitors communication of an Internet of Things (IoT) device, a normal communication model that is used for monitoring the communication and indicates a characteristic of normal communication of the IoT device, cluster a normal communication model group of a same feature among acquired normal communication model groups, calculate a majority cluster that is a cluster having a largest number of normal communication models by using a result of the clustering, and calculate an average model of the normal communication model group belonging to the majority cluster, and notify the network traffic sensor serving as an acquisition source of the normal communication model of attribution information indicating whether or not the normal communication model belongs to the majority cluster and the average model.