An analysis method performed by an analysis device , the analysis method comprising: a network standpoint feature value creating step of classifying first access data that is collected at a plurality of observation points in a network and that is related to an access to a server in the network into each detection target access source that is an access source of the access and creating network standpoint feature values that are feature values of the first access data for each of the detection target access sources; an access source detecting step of detecting, based on the network standpoint feature values, from among the detection target access sources, an access source that performs a predetermined continuous access; a point standpoint feature value creating step of creating detection target standpoint feature values that are feature values for each piece of second access data that is collected at a single observation point in the network and that is related to an access to a server in the network and training standpoint feature values that are feature values for each piece of the first access data in which, from among pieces of the first access data, an access source is the access source detected at the access source detecting step; and an access detecting step of detecting, from among pieces of the second access data, the second access data in which the similarity between the detection target standpoint feature value and the training standpoint feature value is equal to or greater than a predetermined value as access data related to the predetermined continuous access. a network standpoint feature value creating step of classifying first access data that is collected at a plurality of observation points in a network and that is related to an access to a server in the network into each detection target access source that is an access source of the access and creating network standpoint feature values that are feature values of the first access data for each of the detection target access sources; an access source detecting step of detecting, based on the network standpoint feature values, from among the detection target access sources, an access source that performs a predetermined continuous access; a point standpoint feature value creating step of creating detection target standpoint feature values that are feature values for each piece of second access data that is collected at a single observation point in the network and that is related to an access to a server in the network and training standpoint feature values that are feature values for each piece of the first access data in which, from among pieces of the first access data, an access source is the access source detected at the access source detecting step; and detection target standpoint feature values that are feature values for each piece of second access data that is collected at a single observation point in the network and that is related to an access to a server in the network and training standpoint feature values that are feature values for each piece of the first access data in which, from among pieces of the first access data, an access source is the access source detected at the access source detecting step; and an access detecting step of detecting, from among pieces of the second access data, the second access data in which the similarity between the detection target standpoint feature value and the training standpoint feature value is equal to or greater than a predetermined value as access data related to the predetermined continuous access. <EOS>