An anomaly detection device comprising: a learning unit that generates a detection model for detecting anomaly of a communication apparatus using a first communication log as learning data, wherein the first communication log is acquired based on network flow information during normal operation of the communication apparatus ; a data acquisition unit that acquires a second communication log based on the network flow during a predetermined period after the first communication log; an anomaly detection unit that detects anomaly of the communication apparatus using the generated detection model and the second communication log of network flow information of the communication apparatus; an additional information identification unit that identifies a part of the second communication log in which the detection model detects anomaly as additional information to the first communication log; a difference information identification unit to compare the first communication log and the second communication log and to determine difference information; a deletion information identification unit that identifies deletion information, wherein the deletion information is obtained by removing the additional information from the difference information between the first communication log and the second communication log; and a determination unit that instructs the learning unit to generate a second detection model using the second communication log as learning data, if the number of pieces of the additional information exceeds a predetermined threshold or the number of pieces of the deletion information exceeds a predetermined threshold or the total number of pieces of the additional information and the deletion information exceeds a predetermined threshold, characterized by the thresholds being determined based on past statistical values. a learning unit that generates a detection model for detecting anomaly of a communication apparatus using a first communication log as learning data, wherein the first communication log is acquired based on network flow information during normal operation of the communication apparatus ; a data acquisition unit that acquires a second communication log based on the network flow during a predetermined period after the first communication log; an anomaly detection unit that detects anomaly of the communication apparatus using the generated detection model and the second communication log of network flow information of the communication apparatus; an additional information identification unit that identifies a part of the second communication log in which the detection model detects anomaly as additional information to the first communication log; a difference information identification unit to compare the first communication log and the second communication log and to determine difference information; a deletion information identification unit that identifies deletion information, wherein the deletion information is obtained by removing the additional information from the difference information between the first communication log and the second communication log; and a determination unit that instructs the learning unit to generate a second detection model using the second communication log as learning data, if the number of pieces of the additional information exceeds a predetermined threshold or the number of pieces of the deletion information exceeds a predetermined threshold or the total number of pieces of the additional information and the deletion information exceeds a predetermined threshold, characterized by the thresholds being determined based on past statistical values. <EOS>