An anomaly detection method includes searching for one principal component axis by analyzing a normal data set collected in time series from a plurality of IoT devices by using a principal component analysis technique, setting a center point of the principal component, receiving a currently measured measurement data set from the plurality of IoT devices, acquiring a linear transformation data set having a plurality of projection points as elements by projecting a plurality of measurement data which is each element in the measurement data set onto the principal component axis, calculating a Mahalanobis distance between the projection point and the central point, and detecting whether or not data of the IoT devices is abnormal by comparing the Mahalanobis distance calculated for each element with a threshold.