An information processing device includes: a first analyzing unit which estimates whether or not a protocol related to a communication flow is a first protocol set in advance by analyzing, each time data is received, the data in accordance with characteristics of the first protocol; and a second analyzing unit which estimates whether or not the protocol related to the communication flow is a second protocol set in advance by analyzing, each time data belonging to the communication flow is received, the data in accordance with characteristics of the second protocol regardless of a result of analysis by the first analyzing unit.