1. A data flow analyzing apparatus comprising: an analysis rule storage which stores analysis rules having definitions of data types; a data flow analyzer which performs data flow analysis on an analysis target program as a target of analysis by using the analysis rules stored in the analysis rule storage to thereby output unsafe data-including procedures as detected points; an analysis rule candidate generator which generates candidates of analysis rules by selecting a point from among the detected points and generating a control flow graph of the procedure at the point and extracting procedure calls from nodes which are reachable in tracing back the control flow graph from the location of the point; and an analysis rule candidate output which outputs the analysis rule candidates generated by the analysis rule candidate generator to a predetermined output.