A learning device (10) according to the present disclosure is provided with: a first classification unit (11) that classifies a plurality of first malware programs, which are existing malware programs collected during a first period, into a plurality of clusters; a second classification unit (12) that classifies a plurality of second malware programs, which are new malware programs collected during a second period, into a plurality of clusters; and a learning unit (13) that creates a learning model for discriminating between malware programs, on the basis of feature quantities of the plurality of clusters resulting from the classification of the plurality of second malware programs.
展开▼
