It is an object of the present invention to provide a device for generating analysis object data that allows the simple setting of an intrusion detection policy, and more specifically, to allow policy setting that performs pattern matching with a plurality of signatures summarized as a single intrusion detection policy, and to allow policy setting that performs pattern matching of the context of an attack and response to this attack.