Fuente: Wipo "IOT" A sensor calculates a degree of spread of a range of normal communication for each normal communication model of an IoT device. Then, the sensor classifies a normal communication model in which a degree of spread is less than a predetermined value as a normal communication model of a stable model, and classifies a normal communication model in which a degree of spread is equal to or greater than a predetermined value as a normal communication model of an IoT device of an unstable model. Thereafter, the sensor detects abnormal communication in the IoT device by using the normal communication model of the IoT device of the stable model, and reconstructs the normal communication model of the IoT device of the unstable model by using the feature amount in which the contribution degree to the detection of the abnormal communication is equal to or greater than a predetermined value among the feature amounts used in the normal communication model. The sensor analyzes abnormal communication common to each IoT device by using abnormal communication of the IoT device of the stable model detected by using the normal communication model and abnormal communication of the IoT device of the unstable model detected by using the reconstructed normal communication model.