A classification device constructs tree structure data in which attribute information relating to a single communication or multiple communications serves as a terminal node, from a series of communications with a single communication destination or multiple communication destinations that take place when software is executed, calculates attribute information on a higher node on the basis of attribute information on the terminal node, and classifies the software by specifying the type of the software on the basis of attribute information on the highest node.