An intrusion path analysis device communicably connectable to a control network system, the control network system including at least one electronic control unit, a communication device, at least one security sensor, and a network communicatively coupling the at least one electronic control unit, the communication device, the at least one security sensor, and the intrusion path analysis device, the intrusion path analysis device comprising: an alert obtainer configured to obtain a security alert from the at least one security sensor, the security alert indicating that an indication of a security breach is detected in at least one of the network, the at least one electronic control unit, or the communication device; an event obtainer configured to obtain an event history comprising information indicating events that occurred in the control network system and times at which the events occurred; and an intrusion path analyzer that configured to perform an analysis on an intrusion path of an attack on the basis of the security alert, the event history, and an intrusion depth indicating an intrusion level to be assumed in a case the security alert occurs, and to output a result of the analysis, wherein, if a plurality of security alerts have been obtained, the intrusion path analyzer is configured to perform the analysis by determining whether an event included in the event history that occurs in the control network system while the plurality of security alerts are obtained is caused by the attack on the basis of a temporal change in intrusion depths of the plurality of security alerts. including at least one electronic control unit, a communication device, at least one security sensor, and a network communicatively coupling the at least one electronic control unit, the communication device, the at least one security sensor, and the intrusion path analysis device, the intrusion path analysis device comprising: an alert obtainer configured to obtain a security alert from the at least one security sensor, the security alert indicating that an indication of a security breach is detected in at least one of the network, the at least one electronic control unit, or the communication device; an event obtainer configured to obtain an event history comprising information indicating events that occurred in the control network system and times at which the events occurred; and an intrusion path analyzer that configured to perform an analysis on an intrusion path of an attack on the basis of the security alert, the event history, and an intrusion depth indicating an intrusion level to be assumed in a case the security alert occurs, and to output a result of the analysis, wherein, if a plurality of security alerts have been obtained, the intrusion path analyzer is configured to perform the analysis by determining whether an event included in the event history that occurs in the control network system while the plurality of security alerts are obtained is caused by the attack on the basis of a temporal change in intrusion depths of the plurality of security alerts. an alert obtainer configured to obtain a security alert from the at least one security sensor, the security alert indicating that an indication of a security breach is detected in at least one of the network, the at least one electronic control unit, or the communication device; an event obtainer configured to obtain an event history comprising information indicating events that occurred in the control network system and times at which the events occurred; and an intrusion path analyzer that configured to perform an analysis on an intrusion path of an attack on the basis of the security alert, the event history, and an intrusion depth indicating an intrusion level to be assumed in a case the security alert occurs, and to output a result of the analysis, wherein, if a plurality of security alerts have been obtained, the intrusion path analyzer is configured to perform the analysis by determining whether an event included in the event history that occurs in the control network system while the plurality of security alerts are obtained is caused by the attack on the basis of a temporal change in intrusion depths of the plurality of security alerts.