An abnormal traffic analysis apparatus includes receiving means for receiving traffic from a device, analysis means for analyzing whether or not traffic received from the device is abnormal traffic, analysis result recording means for recording a result of analysis performed by the analysis means, and device management means for managing movement of the device between edges. If it is determined by the device management means that a device that is a target of analysis performed by the analysis means moves to an edge, the receiving means creates information for continuing analysis of traffic received from the device and transmits the information to an apparatus for analyzing traffic that is included in the edge to which the device moves.