An anomaly detection apparatus according to the present disclosure includes a binary tree structure creation unit, a score calculation unit, and a learning unit. The binary tree structure creation unit creates a binary tree structure using a plurality of data pieces. The score calculation unit calculates a score using a node evaluation value for a node feature vector, the node feature vector being a feature of each node passing from a root node to a leaf node of the binary tree structure. The learning unit learns a node evaluation model for calculating the node evaluation value for the node feature vector of the each node of the binary tree structure.