A classification method executed by a classification device, the classification method comprising: a step of constructing tree structure data in which attribute information relating to a single communication or multiple communications serves as a terminal node, from a series of communications with a single communication destination or multiple communication destinations that take place when software is executed; a step of calculating attribute information on a higher node based on attribute information on the terminal node; and a step of classifying the software by specifying a type of the software based on attribute information on a highest node, characterized in that it is possible to optionally select the step of constructing to be performed by repeating one of a process of creating a new higher node relative to two nodes with closest communication occurrence times among multiple the terminal nodes based on attribute information on the two nodes, and creating a new higher node relative to two nodes with closest times among nodes that do not have a higher node including a newly created node based on attribute information on the two nodes; a process of creating a new higher node relative to two nodes including a node with an earliest communication occurrence time and a node with a second earliest communication occurrence time among multiple the terminal nodes based on attribute information on the two nodes, and creating a new higher node relative to two nodes including a node with an earliest communication occurrence time and a node with a second earliest communication occurrence time among nodes that do not have a higher node including a newly created node based on attribute information on the two nodes; or a process of creating a new higher node relative to two nodes with highly similar attribute information among multiple the terminal nodes based on attribute information on the two nodes, and creating a new higher node relative to two nodes with highly similar attribute information among nodes that do not have a higher node including a newly created node based on attribute information on the two nodes. a step of constructing tree structure data in which attribute information relating to a single communication or multiple communications serves as a terminal node, from a series of communications with a single communication destination or multiple communication destinations that take place when software is executed; a step of calculating attribute information on a higher node based on attribute information on the terminal node; and a step of classifying the software by specifying a type of the software based on attribute information on a highest node, characterized in that it is possible to optionally select the step of constructing to be performed by repeating one of a process of creating a new higher node relative to two nodes with closest communication occurrence times among multiple the terminal nodes based on attribute information on the two nodes, and creating a new higher node relative to two nodes with closest times among nodes that do not have a higher node including a newly created node based on attribute information on the two nodes; a process of creating a new higher node relative to two nodes including a node with an earliest communication occurrence time and a node with a second earliest communication occurrence time among multiple the terminal nodes based on attribute information on the two nodes, and creating a new higher node relative to two nodes including a node with an earliest communication occurrence time and a node with a second earliest communication occurrence time among nodes that do not have a higher node including a newly created node based on attribute information on the two nodes; or a process of creating a new higher node relative to two nodes with highly similar attribute information among multiple the terminal nodes based on attribute information on the two nodes, and creating a new higher node relative to two nodes with highly similar attribute information among nodes that do not have a higher node including a newly created node based on attribute information on the two nodes.