A communication log aggregation device used in a control network system, wherein the control network system includes two or more subnetworks, the communication log aggregation device being disposed in the control network system and comprising: an obtainer that is configured to obtain flow information including one or more flow records and first statistical information for each flow from each of collection devices (300a-300d), the one or more flow records each including flow identification information included in a message received by at least one observer (300a-300d), the flow being classified based on the flow identification information, the collection devices each being disposed in a different one of the two or more subnetworks and each collecting the one or more flow records and the first statistical information for each flow from the message received by the at least one observer, the at least one observer being disposed in the control network system and receiving the message; and an information processor that is configured to generate aggregated flow information by performing at least one of the following: (i) selecting at least one of the one or more flow records included in one or more flow information items in the flow information obtained, (ii) adding second statistical information based on the first statistical information, and (iii) deleting at least one of the one or more flow records, and outputs the aggregated flow information generated, characterized in that the communication log aggregation device is installed in a vehicle, and the information processor is configured to further perform, based on a vehicle state of the vehicle, at least one of the following: (i) selecting at least one of the one or more flow records; (ii) adding the second statistical information; and (iii) deleting at least one of the one or more flow records. an obtainer that is configured to obtain flow information including one or more flow records and first statistical information for each flow from each of collection devices (300a-300d), the one or more flow records each including flow identification information included in a message received by at least one observer (300a-300d), the flow being classified based on the flow identification information, the collection devices each being disposed in a different one of the two or more subnetworks and each collecting the one or more flow records and the first statistical information for each flow from the message received by the at least one observer, the at least one observer being disposed in the control network system and receiving the message; and an information processor that is configured to generate aggregated flow information by performing at least one of the following: (i) selecting at least one of the one or more flow records included in one or more flow information items in the flow information obtained, (ii) adding second statistical information based on the first statistical information, and (iii) deleting at least one of the one or more flow records, and (i) selecting at least one of the one or more flow records included in one or more flow information items in the flow information obtained, (ii) adding second statistical information based on the first statistical information, and (iii) deleting at least one of the one or more flow records, and outputs the aggregated flow information generated, characterized in that the communication log aggregation device is installed in a vehicle, and the information processor is configured to further perform, based on a vehicle state of the vehicle, at least one of the following: (i) selecting at least one of the one or more flow records; (ii) adding the second statistical information; and (iii) deleting at least one of the one or more flow records. (i) selecting at least one of the one or more flow records; (ii) adding the second statistical information; and (iii) deleting at least one of the one or more flow records.