Detection device, vehicle, detection method, and detection program

Abstract

A detection device includes: a monitoring unit configured to monitor, as target messages, an authorized message being periodically transmitted and the unauthorized message in the in-vehicle network; and a generation unit configured to generate a reference time to be used in a detection process of detecting the unauthorized message; a detection unit configured to perform detection process, based on time difference between a time corresponding to a transmission time of target message based on a monitoring result of the monitoring unit, and the reference time generated by the generation unit. When target message has been determined to be abnormal in the detection process, the generation unit, based on a value obtained by adding a latest statistical value to the reference time, generates a new reference time to be used in the detection process for a target message to be transmitted after the target message having been determined to be abnormal.