A detection system for abnormality-based threat detection for IoT apparatuses, the detection system comprising: a detection apparatus configured to detect an abnormality of communication data that are generated from an IoT apparatus, based on models representing characteristics of a probability density of the communication data; and a learning apparatus configured to update parameters of the models, wherein the learning apparatus includes an acquisition unit configured to acquire a plurality of pieces of normal communication data being a learning target that are generated from the IoT apparatus, a first estimation unit configured to learn the normal communication data, and estimate the probability density of the normal communication data, a clustering unit configured to cluster the normal communication data according to the probability density estimated by the first estimation unit, a second estimation unit configured to perform learning for each of a plurality of clusters resulting from clustering by the clustering unit, and estimate respective pieces of the probability density of the normal communication data for respective clusters and update parameters of a model for each of the clusters by using, as initial values of the parameters, the parameters learned in the first estimation unit, and an integration unit configured to integrate the respective pieces of probability density for the respective clusters that are estimated, and the detection apparatus includes a third estimation unit configured to apply the parameters of the models updated by the second estimation unit, and estimate the probability density of communication data of a detection target and a detection unit configured to detect presence or absence of an abnormality of the communication data of the detection target, based on the probability density estimated by the third estimation unit. a detection apparatus configured to detect an abnormality of communication data that are generated from an IoT apparatus, based on models representing characteristics of a probability density of the communication data; and a learning apparatus configured to update parameters of the models, wherein the learning apparatus includes an acquisition unit configured to acquire a plurality of pieces of normal communication data being a learning target that are generated from the IoT apparatus, a first estimation unit configured to learn the normal communication data, and estimate the probability density of the normal communication data, a clustering unit configured to cluster the normal communication data according to the probability density estimated by the first estimation unit, a second estimation unit configured to perform learning for each of a plurality of clusters resulting from clustering by the clustering unit, and estimate respective pieces of the probability density of the normal communication data for respective clusters and update parameters of a model for each of the clusters by using, as initial values of the parameters, the parameters learned in the first estimation unit, and an integration unit configured to integrate the respective pieces of probability density for the respective clusters that are estimated, and the detection apparatus includes a third estimation unit configured to apply the parameters of the models updated by the second estimation unit, and estimate the probability density of communication data of a detection target and a detection unit configured to detect presence or absence of an abnormality of the communication data of the detection target, based on the probability density estimated by the third estimation unit.