An attack detection device comprising: an event stage information storage unit which stores, for a plurality of events, event stage information describing an event, a pre-event stage, and a post-event stage, the event being observed by an information system when an attack against the information system is underway, the pre-event stage being a stage of a progress of an attack which is made before the event is observed, the post-event stage being a stage of a progress of an attack which is made after the event is observed; an observed event notice information reception unit (2, 3) which receives observed event notice information notifying an observed event observed by the information system; an event sequence creation unit (4, 28) which searches for event stage information describing the observed event notified by the observed event notice information, from the event stage information storage unit, searches for event stage information describing a post-event stage coinciding with a pre-event stage of the event stage information or a pre-event stage coinciding with a post-event stage of the event stage information, from the event stage information storage unit, and if an event of the event stage information searched for is an observation non-available event that cannot be observed, creates an event sequence by treating the observation non-available event as having been observed and connecting the observed event and the observation non-available event to each other with a dependency; and further comprising a chain probability storage unit which stores a chain probability of the plurality of events, wherein the event sequence creation unit (4, 28) calculates an occurrence probability of the observation non-available event based on the chain probability stored in the chain probability storage unit, wherein the chain probability is the probability at which a plurality of events occur in a chain, and if the calculated occurrence probability is equal to or larger than a threshold value, the event sequence creation unit (4, 28) determines the observation non-available event as having been observed, and creates an event sequence by treating the observation non-available event as having been observed and connecting the observed event and the observation non-available event to each other with a dependency. an event stage information storage unit which stores, for a plurality of events, event stage information describing an event, a pre-event stage, and a post-event stage, the event being observed by an information system when an attack against the information system is underway, the pre-event stage being a stage of a progress of an attack which is made before the event is observed, the post-event stage being a stage of a progress of an attack which is made after the event is observed; an observed event notice information reception unit (2, 3) which receives observed event notice information notifying an observed event observed by the information system; an event sequence creation unit (4, 28) which searches for event stage information describing the observed event notified by the observed event notice information, from the event stage information storage unit, searches for event stage information describing a post-event stage coinciding with a pre-event stage of the event stage information or a pre-event stage coinciding with a post-event stage of the event stage information, from the event stage information storage unit, and if an event of the event stage information searched for is an observation non-available event that cannot be observed, creates an event sequence by treating the observation non-available event as having been observed and connecting the observed event and the observation non-available event to each other with a dependency; and further comprising a chain probability storage unit which stores a chain probability of the plurality of events, wherein the event sequence creation unit (4, 28) calculates an occurrence probability of the observation non-available event based on the chain probability stored in the chain probability storage unit, wherein the chain probability is the probability at which a plurality of events occur in a chain, and if the calculated occurrence probability is equal to or larger than a threshold value, the event sequence creation unit (4, 28) determines the observation non-available event as having been observed, and creates an event sequence by treating the observation non-available event as having been observed and connecting the observed event and the observation non-available event to each other with a dependency.