An intrusion prevention device connected with a network in which a packet containing a command for a device to be controlled is transmitted, where a content of the command is set according to a predetermined rule, the intrusion prevention device comprising: an analysis table storage part that stores an analysis table comprised of a predetermined number of slots for storing a predetermined number of the commands together with time information; and a parse part that inserts the command extracted from the packet detected from the network into the analysis table, characterized in that: the packet containing the command for the device to be controlled is regularly transmitted at a predetermined time cycle; the slots of the analysis table correspond to each of the time cycles; the parse part inserts the command into a slot of the analysis table corresponding to the time cycle when the packet is received; and the intrusion prevention device further comprises: an analysis part that analyzes whether or not the plurality of the commands stored in the slots of the analysis table follow the predetermined rule; and an output part that, when an analysis result by the analysis part indicates an abnormality, alters contents of the command included in the packet detected from the network into contents that can be set according to the predetermined rule, and transmits the packet to the network, wherein analyzing whether or not the plurality of the commands stored in the slots of the analysis table follow the predetermined rule comprises analyzing whether or not positions of slots storing the commands among the slots of the analysis table match the time cycle. an analysis table storage part that stores an analysis table comprised of a predetermined number of slots for storing a predetermined number of the commands together with time information; and a parse part that inserts the command extracted from the packet detected from the network into the analysis table, characterized in that: the packet containing the command for the device to be controlled is regularly transmitted at a predetermined time cycle; the slots of the analysis table correspond to each of the time cycles; the parse part inserts the command into a slot of the analysis table corresponding to the time cycle when the packet is received; and the packet containing the command for the device to be controlled is regularly transmitted at a predetermined time cycle; the slots of the analysis table correspond to each of the time cycles; the parse part inserts the command into a slot of the analysis table corresponding to the time cycle when the packet is received; and the intrusion prevention device further comprises: an analysis part that analyzes whether or not the plurality of the commands stored in the slots of the analysis table follow the predetermined rule; and an output part that, when an analysis result by the analysis part indicates an abnormality, alters contents of the command included in the packet detected from the network into contents that can be set according to the predetermined rule, and transmits the packet to the network, wherein analyzing whether or not the plurality of the commands stored in the slots of the analysis table follow the predetermined rule comprises analyzing whether or not positions of slots storing the commands among the slots of the analysis table match the time cycle. an analysis part that analyzes whether or not the plurality of the commands stored in the slots of the analysis table follow the predetermined rule; and an output part that, when an analysis result by the analysis part indicates an abnormality, alters contents of the command included in the packet detected from the network into contents that can be set according to the predetermined rule, and transmits the packet to the network, wherein analyzing whether or not the plurality of the commands stored in the slots of the analysis table follow the predetermined rule comprises analyzing whether or not positions of slots storing the commands among the slots of the analysis table match the time cycle.