An analysis device of the present invention includes: a window length decision part that decides a window length of a data stream including tuples each including a timestamp and an observed value; a graph construction part that constructs a graph representing a preset relation between the tuples within a window obtained by dividing the data steam by the decided window length; a tensor construction part that constructs a tensor or a matrix equivalent to the tensor from a plurality of graphs constructed for a plurality of windows, respectively; a pattern extraction part that extracts a pattern from the tensor or the matrix equivalent to the tensor; and a difference extraction part that extracts a residual portion that does not match the extracted pattern, from the data stream. The window length decision part decides a new window length that is different from the previously decided window length.