A malicious communication pattern extraction device that extracts a malicious communication pattern to detect traffic caused by malware, the malicious communication pattern extraction device, comprising: a statistical value calculation unit that calculates a statistical value for an appearance frequency of each of a plurality of communication patterns that is a combination of a field and a value, from a first traffic log obtained from the traffic caused by malware, and a second traffic log obtained from traffic in a predetermined communication environment; an extraction unit that compares between the appearance frequency of the first traffic log and the appearance frequency of the second traffic log for each of the communication patterns, based on the statistical value calculated by the statistical value calculation unit, and extracts the communication pattern as the malicious communication pattern when a difference between both of the appearance frequencies is equal to or more than a predetermined threshold; and a threshold setting unit that sets a threshold to detect whether traffic is caused by malware, when the malicious communication pattern extracted by the extraction unit is applied, the threshold being a threshold for number of times the communication pattern is matched with at least one type of the malicious communication pattern, or a threshold for number of types of the malicious communication pattern when the communication pattern is matched with the malicious communication pattern, and the threshold being set so that an erroneous detection rate that is probability of erroneously detecting the traffic caused by malware is equal to or less than a certain value as well as a detection rate that is probability of detecting the traffic caused by malware is equal to or more than a certain value. a statistical value calculation unit that calculates a statistical value for an appearance frequency of each of a plurality of communication patterns that is a combination of a field and a value, from a first traffic log obtained from the traffic caused by malware, and a second traffic log obtained from traffic in a predetermined communication environment; an extraction unit that compares between the appearance frequency of the first traffic log and the appearance frequency of the second traffic log for each of the communication patterns, based on the statistical value calculated by the statistical value calculation unit, and extracts the communication pattern as the malicious communication pattern when a difference between both of the appearance frequencies is equal to or more than a predetermined threshold; and a threshold setting unit that sets a threshold to detect whether traffic is caused by malware, when the malicious communication pattern extracted by the extraction unit is applied, the threshold being a threshold for number of times the communication pattern is matched with at least one type of the malicious communication pattern, or a threshold for number of types of the malicious communication pattern when the communication pattern is matched with the malicious communication pattern, and the threshold being set so that an erroneous detection rate that is probability of erroneously detecting the traffic caused by malware is equal to or less than a certain value as well as a detection rate that is probability of detecting the traffic caused by malware is equal to or more than a certain value.