1. A failure analysis device which is connected to a plurality of routers on a network, the failure analysis device comprising one or more computers, the one or more computers comprising: a receiving unit configured to receive information associated with every traffic flow, which is acquired by each of the routers as a data group; a storing unit that stores the received data group; and a failure analyzing unit configured to set the stored data group for every router as at least one analysis parameter for every failure, calculate a Mahalanobis distance with respect to a reference distribution of the analysis parameter, and perform abnormality determination using the Mahalanobis distance with respect to the reference distribution for every router, wherein when the failure analyzing unit performs the abnormality determination using the Mahalanobis distance for the reference distribution, the failure analyzing unit is configured to update expected values of an average value and a standard deviation of the reference distribution which are used for the abnormality determination of the routers using a simple moving average or a weighted moving average, and wherein when the failure analyzing unit updates the expected values of the average value and the standard deviation of the reference distribution which are used for the abnormality determination using the weighted moving average, a weight of the data that uses a weighted average uses a value inversely proportional to the Mahalanobis distance.