A device for detecting a malware infected terminal, the device comprising: a sequence generation unit that generates an event sequence from events that match a rule characterizing a communication among communications in a monitoring target network and communications caused by malware and that are acquired for each of identifiers that distinguish among terminals in the monitoring target network or pieces of malware, by taking into account an order of occurrence of the events; a detection sequence extraction unit that retrieves events that commonly occur in event sequences belonging to a same cluster among clusters including event sequences with similarities at a predetermined level or higher among event sequences based on a communication caused by malware, extracts, as common event sequences, event sequences in which the retrieved events are connected in chronological order in a predetermined length or longer, and extracts, as a detection event sequence, a representative event sequence based on a relationship between events that have high occurrence rates in similar common event sequences among the plurality of common event sequences; and a detection unit that detects that a malware infected terminal is present in the monitoring target network when it is determined that the event sequence generated by the sequence generation unit based on a communication in the monitoring target network and the detection event sequence extracted by the detection sequence extraction unit match each other, wherein the detection sequence extraction unit generates, from the common event sequences, a digraph in which nodes represent the events, edges represent an order of occurrence of the events, and weights of the edges represent numbers of occurrences of before-after relationships of the events, calculates a sum of the weights for each of simple paths of the digraph, and uses a simple path with a maximum sum of the weights as the representative event sequence. a sequence generation unit that generates an event sequence from events that match a rule characterizing a communication among communications in a monitoring target network and communications caused by malware and that are acquired for each of identifiers that distinguish among terminals in the monitoring target network or pieces of malware, by taking into account an order of occurrence of the events; a detection sequence extraction unit that retrieves events that commonly occur in event sequences belonging to a same cluster among clusters including event sequences with similarities at a predetermined level or higher among event sequences based on a communication caused by malware, extracts, as common event sequences, event sequences in which the retrieved events are connected in chronological order in a predetermined length or longer, and extracts, as a detection event sequence, a representative event sequence based on a relationship between events that have high occurrence rates in similar common event sequences among the plurality of common event sequences; and retrieves events that commonly occur in event sequences belonging to a same cluster among clusters including event sequences with similarities at a predetermined level or higher among event sequences based on a communication caused by malware, extracts, as common event sequences, event sequences in which the retrieved events are connected in chronological order in a predetermined length or longer, and extracts, as a detection event sequence, a representative event sequence based on a relationship between events that have high occurrence rates in similar common event sequences among the plurality of common event sequences; and a detection unit that detects that a malware infected terminal is present in the monitoring target network when it is determined that the event sequence generated by the sequence generation unit based on a communication in the monitoring target network and the detection event sequence extracted by the detection sequence extraction unit match each other, wherein the detection sequence extraction unit generates, from the common event sequences, a digraph in which nodes represent the events, edges represent an order of occurrence of the events, and weights of the edges represent numbers of occurrences of before-after relationships of the events, calculates a sum of the weights for each of simple paths of the digraph, and uses a simple path with a maximum sum of the weights as the representative event sequence.