An anomaly detection apparatus according to an embodiment of the present disclosure includes: a global tree structure creation unit configured to create a global tree structure for dividing a plurality of data pieces into a plurality of groups, a local tree structure creation unit configured to create a local tree structure for further dividing the data pieces divided into the plurality of groups for each of the plurality of groups, and a score calculation unit configured to calculate a score indicating an anomaly level of the plurality of data pieces using a depth from a root node to a leaf node of the local tree structure.