A communication apparatus that transfers received data stores a whitelist to manage an allowed object that is allowed to perform communications via the communication apparatus, comprises: a transfer unit that performs transfer control on the received data based on the whitelist; and a control unit that analyzes behavior related to communications performed by the allowed object. The control unit being configured to calculate a monitoring parameter that indicates the behavior related to the communications performed by the allowed object, and detect the allowed object where an abnormality occurred based on the monitoring parameter.