A detection system including a detection apparatus and a learning apparatus, the learning apparatus comprising: a first input unit configured to receive a first input of first information relating to a web page, whether or not the web page is a malicious site being known, the malicious site presenting a false virus removal method; and a learning unit configured to generate a training model using, as training data, any one feature or a plurality of features from among a word/phrase-related feature, an image-related feature, an HTML source code-related feature and a communication log-related feature, the feature or the features being included in the first information relating to the web page, and the detection apparatus comprising: a second input unit configured to receive a second input of second information relating to a web page; and a detection unit configured to input input data to the training model, using, as the input data, any one feature or a plurality of features from among a word/phrase-related feature, an image-related feature, an HTML source code-related feature and a communication log-related feature, the feature or the features being included in the second information relating to the web page, and detect that the web page is a malicious site presenting a false virus removal method, according to an output result of the training model. a first input unit configured to receive a first input of first information relating to a web page, whether or not the web page is a malicious site being known, the malicious site presenting a false virus removal method; and a learning unit configured to generate a training model using, as training data, any one feature or a plurality of features from among a word/phrase-related feature, an image-related feature, an HTML source code-related feature and a communication log-related feature, the feature or the features being included in the first information relating to the web page, and the detection apparatus comprising: a second input unit configured to receive a second input of second information relating to a web page; and a detection unit configured to input input data to the training model, using, as the input data, any one feature or a plurality of features from among a word/phrase-related feature, an image-related feature, an HTML source code-related feature and a communication log-related feature, the feature or the features being included in the second information relating to the web page, and detect that the web page is a malicious site presenting a false virus removal method, according to an output result of the training model. a second input unit configured to receive a second input of second information relating to a web page; and a detection unit configured to input input data to the training model, using, as the input data, any one feature or a plurality of features from among a word/phrase-related feature, an image-related feature, an HTML source code-related feature and a communication log-related feature, the feature or the features being included in the second information relating to the web page, and detect that the web page is a malicious site presenting a false virus removal method, according to an output result of the training model.