A learning data selection program which, when executed by a computer, causes the computer to execute a process comprising: extracting a first input data group (v1 to v3) relating to first input data in response to designation of the first input data included in an input data group input to a first machine learning model (120, 130), in accordance with a reference in which a collection timing of each data of the first input data group in which a data generation source of each data of the first input data group has a predetermined relationship with the first input data, the first input data being determined by receiving, from a user, designation as selection data that is input data for the estimation of a feature which causes the first machine learning model to output a classification result; acquiring a first transformed data group generated by transforming the first input data group by the first machine learning model, the first transformed data group including first transformed data based on the first input data, the transforming including transforming dimensions and values of the first input data group and the first input data, the transformed dimensions and values being to be processed by a classification unit; calculating a first set of distances between the first input data and each data of the first input data group other than the first input data, based on similarity between the first input data and the each data, and calculating a second set of distances between the first transformed data and each data of the first transformed data group other than the first transformed data, based on similarity between the first transformed data and the each data; selecting learning target data from the first input data group by calculating the sum of the distances from the first input data, for the each data of the first input data group other than the first input data, with respect to each distance included in the first set of distances and the second set of distances, and excluding data having a greater sum of the distances; and performing, based on the selected learning target data, machine learning of a second machine learning model configured to estimate a factor which causes the second machine learning model to output a classification result and that the classification result is a result of classifying data of a communication log for every unit time zone in correspondence with presence or absence of unauthorized communication in a corresponding unit time zone, wherein the communication log comprises at least one packet that is transmitted and received through a computer network. extracting a first input data group (v1 to v3) relating to first input data in response to designation of the first input data included in an input data group input to a first machine learning model (120, 130), in accordance with a reference in which a collection timing of each data of the first input data group in which a data generation source of each data of the first input data group has a predetermined relationship with the first input data, the first input data being determined by receiving, from a user, designation as selection data that is input data for the estimation of a feature which causes the first machine learning model to output a classification result; acquiring a first transformed data group generated by transforming the first input data group by the first machine learning model, the first transformed data group including first transformed data based on the first input data, the transforming including transforming dimensions and values of the first input data group and the first input data, the transformed dimensions and values being to be processed by a classification unit; calculating a first set of distances between the first input data and each data of the first input data group other than the first input data, based on similarity between the first input data and the each data, and calculating a second set of distances between the first transformed data and each data of the first transformed data group other than the first transformed data, based on similarity between the first transformed data and the each data; selecting learning target data from the first input data group by calculating the sum of the distances from the first input data, for the each data of the first input data group other than the first input data, with respect to each distance included in the first set of distances and the second set of distances, and excluding data having a greater sum of the distances; and performing, based on the selected learning target data, machine learning of a second machine learning model configured to estimate a factor which causes the second machine learning model to output a classification result and that the classification result is a result of classifying data of a communication log for every unit time zone in correspondence with presence or absence of unauthorized communication in a corresponding unit time zone, wherein the communication log comprises at least one packet that is transmitted and received through a computer network.