An anomaly determination method for determining an anomaly in a received message, the anomaly determination method comprising: receiving a message that includes a first field having a message ID and a second field having a variable value; calculating an available execution time for determining the anomaly in the received message, wherein the available execution time is calculated according to an amount of messages sent to an in-vehicle network system, an amount of data included in the messages, and a number of message transfer destinations; when the available execution time is shorter than a total processing time of a plurality of anomaly determination functions (S1102 YES): • selecting one combination of one or more anomaly determination functions among a plurality of combinations of one or more determination functions such that the anomaly determination using said selected combination does not exceed the available execution time, wherein each of the plurality of combinations includes at least one of: - an anomaly determination function utilizing a reception timing based on a periodicity or a total number of received messages, - an anomaly determination function utilizing the first field, and - an anomaly determination function utilizing the second field; and • performing the anomaly determination on the received message using the one or more determination functions of the selected combination; and when the available execution time is longer than the total processing time (S1102 NO): • performing the anomaly determination on the received message using all of the plurality of anomaly determination functions. receiving a message that includes a first field having a message ID and a second field having a variable value; calculating an available execution time for determining the anomaly in the received message, wherein the available execution time is calculated according to an amount of messages sent to an in-vehicle network system, an amount of data included in the messages, and a number of message transfer destinations; when the available execution time is shorter than a total processing time of a plurality of anomaly determination functions (S1102 YES): • selecting one combination of one or more anomaly determination functions among a plurality of combinations of one or more determination functions such that the anomaly determination using said selected combination does not exceed the available execution time, wherein each of the plurality of combinations includes at least one of: - an anomaly determination function utilizing a reception timing based on a periodicity or a total number of received messages, - an anomaly determination function utilizing the first field, and - an anomaly determination function utilizing the second field; and • performing the anomaly determination on the received message using the one or more determination functions of the selected combination; and • selecting one combination of one or more anomaly determination functions among a plurality of combinations of one or more determination functions such that the anomaly determination using said selected combination does not exceed the available execution time, wherein each of the plurality of combinations includes at least one of: - an anomaly determination function utilizing a reception timing based on a periodicity or a total number of received messages, - an anomaly determination function utilizing the first field, and - an anomaly determination function utilizing the second field; and - an anomaly determination function utilizing a reception timing based on a periodicity or a total number of received messages, - an anomaly determination function utilizing the first field, and - an anomaly determination function utilizing the second field; and • performing the anomaly determination on the received message using the one or more determination functions of the selected combination; and when the available execution time is longer than the total processing time (S1102 NO): • performing the anomaly determination on the received message using all of the plurality of anomaly determination functions. • performing the anomaly determination on the received message using all of the plurality of anomaly determination functions.