A detection system for abnormality-based threat detection for IoT apparatuses, the detection system comprising: a detection apparatus configured to detect an abnormality of communication data that are generated from an IoT apparatus , based on models representing characteristics of a probability density of the communication data; and a learning apparatus configured to update parameters of the models, wherein the learning apparatus includes an acquisition unit configured to acquire a plurality of pieces of normal communication data being a learning target that are generated from the IoT apparatus , a first estimation unit configured to learn the normal communication data, and estimate the probability density of the normal communication data, a clustering unit configured to cluster the normal communication data according to the probability density estimated by the first estimation unit , a second estimation unit configured to perform learning for each of a plurality of clusters resulting from clustering by the clustering unit , and estimate respective pieces of the probability density of the normal communication data for respective clusters and update parameters of a model for each of the clusters by using, as initial values of the parameters, the parameters learned in the first estimation unit , and an integration unit configured to integrate the respective pieces of probability density for the respective clusters that are estimated, and the detection apparatus includes a third estimation unit configured to apply the parameters of the models updated by the second estimation unit , and estimate the probability density of communication data of a detection target and a detection unit configured to detect presence or absence of an abnormality of the communication data of the detection target, based on the probability density estimated by the third estimation unit . a detection apparatus configured to detect an abnormality of communication data that are generated from an IoT apparatus , based on models representing characteristics of a probability density of the communication data; and a learning apparatus configured to update parameters of the models, wherein the learning apparatus includes an acquisition unit configured to acquire a plurality of pieces of normal communication data being a learning target that are generated from the IoT apparatus , a first estimation unit configured to learn the normal communication data, and estimate the probability density of the normal communication data, a clustering unit configured to cluster the normal communication data according to the probability density estimated by the first estimation unit , a second estimation unit configured to perform learning for each of a plurality of clusters resulting from clustering by the clustering unit , and estimate respective pieces of the probability density of the normal communication data for respective clusters and update parameters of a model for each of the clusters by using, as initial values of the parameters, the parameters learned in the first estimation unit , and an integration unit configured to integrate the respective pieces of probability density for the respective clusters that are estimated, and the detection apparatus includes a third estimation unit configured to apply the parameters of the models updated by the second estimation unit , and estimate the probability density of communication data of a detection target and a detection unit configured to detect presence or absence of an abnormality of the communication data of the detection target, based on the probability density estimated by the third estimation unit . <EOS>