Provided is a signature generation device, etc., generating signature information with high accuracy. The signature generation device calculates hash values for at least a partial area in individual files; calculates a similarity degree between the calculated hash values and classifies the plurality of files into groups based on the calculated degree; specifies common strings among, at least, some of the files in strings included in files of a group, the strings being symbol strings or bit strings; and generates signature information being a criterion for determining whether or not at least a part of the common string in the specified common strings is included.