1. A model generating device comprising: an acquiring unit that observes information flowing through a network to which a plurality of information processing devices are connected that execute a plurality of events in a hierarchical structure, the acquiring unit acquiring event information including a time when execution of an event is started, a time when execution of the event is finished, and a type of the event; an assuming unit that assumes model candidates each showing a relationship between an event and another event triggered by the former event on the basis of the event information acquired by the acquiring unit, and makes a combination of the assumed model candidates; a searching unit that searches the model candidates assumed by the assuming unit for a candidate that matches an existing model; an updating unit that withdraws the model candidate searched for by the searching unit from the combination of the model candidates, and withdraws a candidate that is to be withdrawn from the combination of the model candidates in association with withdrawal of the model candidate found as a result of the search, thereby updating the combination of the model candidates; and a generating unit that generates a new model on the basis of the combination of the model candidates updated by the updating unit.