An unauthorized communication detection method in an onboard network system including a network (200, 200a, 200b) and one or more electronic control units (100, 100a to 100g) connected to the network, that is executed by an information processing system including a memory, the memory storing a communication pattern seen in attack messages that have been received, the unauthorized communication detection method comprising steps of: a communication pattern determining step of determining whether or not a message matches the communication pattern identified in the communication pattern identifying step, an unauthorized activity detection step of determining, based on rules and a result of the communication pattern determining step whether or not the message sent out onto the network is an attack message; an information saving step of saving information relating to the attack message determined in the unauthorized activity detection step in the memory in a case where the message is an attack message; a communication pattern identifying step of identifying a communication pattern occurring on the onboard network, from the information relating to the attack message stored in the memory and updating the communication pattern in the memory; and wherein at least the unauthorized activity detection step and the communication pattern determining step are executed on each of a plurality of messages that have been successively sent out onto the network and received, and wherein, in the unauthorized activity detection step executed on a second message among the plurality of messages received after executing of the communication pattern determining step, determination results of this communication pattern determining step that has already been executed on a first message among the plurality of messages are used for determining whether or not this message is an attack message. a communication pattern determining step of determining whether or not a message matches the communication pattern identified in the communication pattern identifying step, an unauthorized activity detection step of determining, based on rules and a result of the communication pattern determining step whether or not the message sent out onto the network is an attack message; an information saving step of saving information relating to the attack message determined in the unauthorized activity detection step in the memory in a case where the message is an attack message; a communication pattern identifying step of identifying a communication pattern occurring on the onboard network, from the information relating to the attack message stored in the memory and updating the communication pattern in the memory; and wherein at least the unauthorized activity detection step and the communication pattern determining step are executed on each of a plurality of messages that have been successively sent out onto the network and received, and wherein, in the unauthorized activity detection step executed on a second message among the plurality of messages received after executing of the communication pattern determining step, determination results of this communication pattern determining step that has already been executed on a first message among the plurality of messages are used for determining whether or not this message is an attack message.