An anomality candidate information analysis apparatus for analyzing anomality candidate information of a monitoring object, comprising: - a storage unit that stores monitoring object information regarding the monitoring object, environment information regarding an environment around the monitoring object, operator information regarding an operator of the monitoring object, and anomality candidate information detected in the monitoring object in association with each other; - an analysis unit that extracts the operator information, and analyzes a dependence degree of the anomality candidate information to the environment information and the operator information, the analysis unit extracts the environment information, the operator information, and the anomality candidate information associated with the monitoring object information, and analyzes a dependence degree of the anomality candidate information to the environment information and the operator information; - a detection unit that is provided on the monitoring object, and detects the monitoring object information, the operator information, and the anomality candidate information; wherein the anomality candidate information analysis apparatus is characterized in that: - a communication unit is provided on the monitoring object, and transmits the monitoring object information, the operator information, and the anomality candidate information detected by the detection unit to the storage unit, - the detection unit includes a driving characteristic learning unit that learns an operation performed by an operator of the monitoring object as a driving characteristic from a detection value of the monitoring object information and predicts the detection value, and - an anomaly operation detection unit is provided that detects the detection value of the monitoring object information as the anomaly candidate information using a prediction value of the detection value predicted by the driving characteristic learning unit as a threshold value. - a storage unit that stores monitoring object information regarding the monitoring object, environment information regarding an environment around the monitoring object, operator information regarding an operator of the monitoring object, and anomality candidate information detected in the monitoring object in association with each other; - an analysis unit that extracts the operator information, and analyzes a dependence degree of the anomality candidate information to the environment information and the operator information, the analysis unit extracts the environment information, the operator information, and the anomality candidate information associated with the monitoring object information, and analyzes a dependence degree of the anomality candidate information to the environment information and the operator information; - a detection unit that is provided on the monitoring object, and detects the monitoring object information, the operator information, and the anomality candidate information; - a communication unit is provided on the monitoring object, and transmits the monitoring object information, the operator information, and the anomality candidate information detected by the detection unit to the storage unit, - the detection unit includes a driving characteristic learning unit that learns an operation performed by an operator of the monitoring object as a driving characteristic from a detection value of the monitoring object information and predicts the detection value, and - an anomaly operation detection unit is provided that detects the detection value of the monitoring object information as the anomaly candidate information using a prediction value of the detection value predicted by the driving characteristic learning unit as a threshold value.