Abnormality sensing device and abnormality sensing method

An abnormality sensing device (30) is provided with: a learning unit (31) that uses a communication log during normal operation of a communication apparatus (10) as learning data to generate a sensing model; and an abnormality sensing unit (32) that uses the generated sensing model to sense an abnormality of the communication apparatus (10). The abnormality sensing device (30) is provided with: a data acquisition unit (330) that acquires a communication log (second communication log) which occurred a predetermined length of time later than a first communication log; and a determination unit (334) that, if there is differential information between the learning data (first communication log) of the current sensing model and the second communication log, commands re-learning using the second communication log, when a number of additional pieces of information (information on additional flow) or number of deleted pieces of information (information on deleted flow) included in the differential information meets a predetermined assessment criterion.