A learning device comprising: an acquisition unit configured to acquire a plurality of pieces of communication data for learning; a feature amount extraction unit configured to extract feature amounts of the communication data; a training unit configured to train a generative model with the feature amounts of the communication data, the generative model for use by a detection device to detect the presence or absence of an anomaly in a detection target traffic in a network (N); characterized by a first representative point extraction unit configured to extract representative points of the feature amounts of the communication data using kernel herding; and an output unit configured to output the representative points extracted by the first representative point extraction unit to a user terminal as data for evaluating whether the generative model has been properly trained; a generation unit configured to generate a plurality of pieces of data from the generative model, and a second representative point extraction unit configured to extract representative points of the generated data using kernel herding, wherein the output unit outputs the representative points extracted by the second representative point extraction unit, and wherein, if a difference between the representative points extracted by the first representative point extraction unit and the representative points extracted by the second representative point extraction unit is larger than a predetermined value, it is determined that the training of the generative model is not progressing appropriately and wherein, if a difference between the representative points extracted by the first representative point extraction unit and the representative points extracted by the second representative point extraction unit is smaller than the predetermined value, it is determined that the training of the generative model is progressing appropriately. an acquisition unit configured to acquire a plurality of pieces of communication data for learning; a feature amount extraction unit configured to extract feature amounts of the communication data; a training unit configured to train a generative model with the feature amounts of the communication data, the generative model for use by a detection device to detect the presence or absence of an anomaly in a detection target traffic in a network (N); characterized by a first representative point extraction unit configured to extract representative points of the feature amounts of the communication data using kernel herding; and an output unit configured to output the representative points extracted by the first representative point extraction unit to a user terminal as data for evaluating whether the generative model has been properly trained; a generation unit configured to generate a plurality of pieces of data from the generative model, and a second representative point extraction unit configured to extract representative points of the generated data using kernel herding, wherein the output unit outputs the representative points extracted by the second representative point extraction unit, and wherein, if a difference between the representative points extracted by the first representative point extraction unit and the representative points extracted by the second representative point extraction unit is larger than a predetermined value, it is determined that the training of the generative model is not progressing appropriately and wherein, if a difference between the representative points extracted by the first representative point extraction unit and the representative points extracted by the second representative point extraction unit is smaller than the predetermined value, it is determined that the training of the generative model is progressing appropriately. <EOS>