An anomaly detection method, comprising: calculating, for a detection target data stream made up of a plurality of detection target data that are consecutive, a plurality of target distances between the plurality of detection target data, wherein each target distance of the plurality of target distances is calculated between consecutive detection target data of the detection target packet data stream by using a Levenshtein distance between a pair of bit strings included in the consecutive detection target data; extracting a plurality of target features of the detection target data stream using the plurality of target distances calculated; and calculating anomaly degree information about a degree of anomaly in the detection target data stream using a plurality of reference features and the plurality of target features extracted, wherein the extracting of the plurality of target features includes extracting the plurality of target features each made up of L consecutive target distances among the plurality of target distances so that each target feature is an L-dimensional vector and is determined on the basis of target distances calculated for the pairs of consecutive detection target data belonging to an information calculation target window, L being an integer greater than or equal to 2, and the calculating of the anomaly degree information includes: calculating supplementary information for each of the plurality of target features extracted, using a difference between the plurality of reference features and the plurality of target features, wherein the supplementary information of a particular target feature is a nearest neighbor distance between the particular target feature and each of the plurality of reference features, the supplementary information being used to calculate the anomaly degree information; and calculating the anomaly degree information for each of one or more information calculation target windows made up of N detection target data among the plurality of detection target data, using all items of supplementary information calculated from the N detection target data, N being an integer greater than or equal to L+1, the calculating of the anomaly degree information includes calculating the anomaly degree information by calculating, for each of the one or more information calculation target windows, a sum of all the items of the supplementary information calculated from the N detection target data. calculating, for a detection target data stream made up of a plurality of detection target data that are consecutive, a plurality of target distances between the plurality of detection target data, wherein each target distance of the plurality of target distances is calculated between consecutive detection target data of the detection target packet data stream by using a Levenshtein distance between a pair of bit strings included in the consecutive detection target data; extracting a plurality of target features of the detection target data stream using the plurality of target distances calculated; and calculating anomaly degree information about a degree of anomaly in the detection target data stream using a plurality of reference features and the plurality of target features extracted, wherein the extracting of the plurality of target features includes extracting the plurality of target features each made up of L consecutive target distances among the plurality of target distances so that each target feature is an L-dimensional vector and is determined on the basis of target distances calculated for the pairs of consecutive detection target data belonging to an information calculation target window, L being an integer greater than or equal to 2, and the calculating of the anomaly degree information includes: calculating supplementary information for each of the plurality of target features extracted, using a difference between the plurality of reference features and the plurality of target features, wherein the supplementary information of a particular target feature is a nearest neighbor distance between the particular target feature and each of the plurality of reference features, the supplementary information being used to calculate the anomaly degree information; and calculating the anomaly degree information for each of one or more information calculation target windows made up of N detection target data among the plurality of detection target data, using all items of supplementary information calculated from the N detection target data, N being an integer greater than or equal to L+1, calculating supplementary information for each of the plurality of target features extracted, using a difference between the plurality of reference features and the plurality of target features, wherein the supplementary information of a particular target feature is a nearest neighbor distance between the particular target feature and each of the plurality of reference features, the supplementary information being used to calculate the anomaly degree information; and calculating the anomaly degree information for each of one or more information calculation target windows made up of N detection target data among the plurality of detection target data, using all items of supplementary information calculated from the N detection target data, N being an integer greater than or equal to L+1,