An anomaly detection method carried out by an anomaly detection device that, in a communication network system, determines whether each of frames, which are contained in observation data constituted by a collection of frames transmitted and received over the communication network system and observed in a predetermined period, is anomalous, and outputs an anomalous part of a payload in a frame determined to be anomalous, the anomaly detection method comprising the steps carried out by the anomaly detection device of: obtaining a data distribution of a plurality of feature amounts pertaining to a part of the payload included in the frame, the part being at least one bit; detecting whether or not the frame contained in the observation data is anomalous; and outputting the anomalous part, wherein in the obtaining, the data distribution is obtained for a collection of frames that are transmitted and received over the communication network system, the collection being obtained at a different timing from a timing at which the observation data is obtained, in the detecting, a difference between the data distribution obtained in the obtaining and a data distribution of a feature amount extracted from the frame contained in the observation data is calculated, and the frame is determined to be an anomalous frame when the frame has a feature amount for which the difference is at least a predetermined value, and in the outputting, when a frame determined to be an anomalous frame in the detecting is present, an anomaly contribution level is calculated for the plurality of feature amounts that have been extracted from the anomalous frame, and an anomalous payload part is output, the anomalous payload part being at least one part in the payload that corresponds to a feature amount for which the anomaly contribution level is at least a predetermined value; and characterized by the anomaly detection method further comprising the step of: determining an anomaly type, wherein in the determining of an anomaly type, an anomalous payload part length is specified based on the anomalous payload part, and the anomaly type is determined according to the anomalous payload part length. obtaining a data distribution of a plurality of feature amounts pertaining to a part of the payload included in the frame, the part being at least one bit; detecting whether or not the frame contained in the observation data is anomalous; and outputting the anomalous part, wherein in the obtaining, the data distribution is obtained for a collection of frames that are transmitted and received over the communication network system, the collection being obtained at a different timing from a timing at which the observation data is obtained, in the detecting, a difference between the data distribution obtained in the obtaining and a data distribution of a feature amount extracted from the frame contained in the observation data is calculated, and the frame is determined to be an anomalous frame when the frame has a feature amount for which the difference is at least a predetermined value, and in the outputting, when a frame determined to be an anomalous frame in the detecting is present, an anomaly contribution level is calculated for the plurality of feature amounts that have been extracted from the anomalous frame, and an anomalous payload part is output, the anomalous payload part being at least one part in the payload that corresponds to a feature amount for which the anomaly contribution level is at least a predetermined value; and characterized by the anomaly detection method further comprising the step of: determining an anomaly type, wherein in the determining of an anomaly type, an anomalous payload part length is specified based on the anomalous payload part, and the anomaly type is determined according to the anomalous payload part length. determining an anomaly type, wherein in the determining of an anomaly type, an anomalous payload part length is specified based on the anomalous payload part, and the anomaly type is determined according to the anomalous payload part length.