1. A failure analysis device which is connected to a plurality of routers on a network, comprising: a receiving unit that receives information for every flow which flows on a traffic and acquired by each of the routers as a data group, a storing unit that stores the received data group; and a failure analyzing unit that sets the stored data group for every router as at least one analysis parameter for every failure, calculates a Mahalanobis distance with respect to a reference distribution of the analysis parameter, and performs abnormality determination using the Mahalanobis distance with respect to the reference distribution for every router.