An attack detection method for detecting an attack on sensor data that is transmitted and received for control of a mobility entity inside the mobility entity, the attack detection method comprising: determining, for each of identifiers of sensor values included in the sensor data, a sampling rule that includes sampling intervals and sampling times in the sampling intervals, on a basis of at least one of a statistic or event information on the mobility entity, the sampling rule being a rule for selecting the sensor values that are used to detect the attack from the sensor data, the statistic indicating a variation in the sensor values included in the sensor data, and the event information indicating timing of a change in the sensor values; generating sampling data that includes two or more sensor values, first order information, and second order information on a basis of the sampling intervals and the sampling times, the two or more sensor values having been selected from the sensor data, the first order information indicating a temporal order of the two or more sensor values acquired during each of the sampling times, and the second order information indicating a temporal order of the two or more sensor values acquired in the sampling intervals; calculating a first anomaly score on a basis of a sensor value serving as evaluation target data included in the sampling data, the first order information, and a short-term sensor flow, the first anomaly score indicating a degree of an anomaly in the evaluation target data, the short-term sensor flow indicating time series data including a past sensor value acquired prior to the sensor value serving as the evaluation target data during a sampling time in which the sensor value serving as the evaluation target data has been acquired, among the sampling times; calculating a second anomaly score on a basis of the sensor value serving as the evaluation target data, the second order information, and a long-term sensor flow, the second anomaly score indicating a degree of an anomaly in the evaluation target data, the long-term sensor flow indicating a change in sensor values acquired during a past sampling interval prior to a sampling interval in which the sensor value serving as the evaluation target data has been acquired among the sampling intervals; determining whether the evaluation target data has resulted from the attack on a basis of the first anomaly score and the second anomaly score that have been calculated; and outputting a determination result. determining, for each of identifiers of sensor values included in the sensor data, a sampling rule that includes sampling intervals and sampling times in the sampling intervals, on a basis of at least one of a statistic or event information on the mobility entity, the sampling rule being a rule for selecting the sensor values that are used to detect the attack from the sensor data, the statistic indicating a variation in the sensor values included in the sensor data, and the event information indicating timing of a change in the sensor values; generating sampling data that includes two or more sensor values, first order information, and second order information on a basis of the sampling intervals and the sampling times, the two or more sensor values having been selected from the sensor data, the first order information indicating a temporal order of the two or more sensor values acquired during each of the sampling times, and the second order information indicating a temporal order of the two or more sensor values acquired in the sampling intervals; calculating a first anomaly score on a basis of a sensor value serving as evaluation target data included in the sampling data, the first order information, and a short-term sensor flow, the first anomaly score indicating a degree of an anomaly in the evaluation target data, the short-term sensor flow indicating time series data including a past sensor value acquired prior to the sensor value serving as the evaluation target data during a sampling time in which the sensor value serving as the evaluation target data has been acquired, among the sampling times; calculating a second anomaly score on a basis of the sensor value serving as the evaluation target data, the second order information, and a long-term sensor flow, the second anomaly score indicating a degree of an anomaly in the evaluation target data, the long-term sensor flow indicating a change in sensor values acquired during a past sampling interval prior to a sampling interval in which the sensor value serving as the evaluation target data has been acquired among the sampling intervals; determining whether the evaluation target data has resulted from the attack on a basis of the first anomaly score and the second anomaly score that have been calculated; and outputting a determination result.