An information processing method, performed by an information processing system including a storage device, for processing data frames flowing in an in-vehicle network, the method comprising: a receiving step of sequentially receiving a plurality of data frames flowing in the in-vehicle network; a frame collection step of recording, in a reception log held in the storage device (180, 190), reception interval information indicating reception intervals between the plurality of data frames as frame information, wherein the frame information further includes a data value included in each of the plurality of data frames in association with the reception interval information; a feature acquisition step of acquiring, from the reception interval information, a feature relating to a distribution of the reception intervals between the plurality of data frames; and an unauthorized data presence determination step of determining the presence/absence of an unauthorized data frame among the plurality of data frames; wherein in the unauthorized data presence determination step, the presence/absence of an unauthorized data frame among the plurality of data frames is determined by using the feature obtained by using the reception interval information and a normal model stored in the storage device, the normal model indicating a property of normal data frames, wherein the method further comprises a grouping step of setting at least one group including at least some of the plurality of data frames on the basis of the reception interval information and the data values included in the frame information, wherein in the feature acquisition step, a feature relating to distribution of the reception intervals between the plurality of data frames included in each of the at least one group is acquired from the reception interval information included in the reception log, and wherein in the unauthorized data presence determination step, a group including an unauthorized data frame and a group not including an unauthorized data frame are identified among the at least one group on the basis of at least the feature obtained for each of the at least one group. a receiving step of sequentially receiving a plurality of data frames flowing in the in-vehicle network; a frame collection step of recording, in a reception log held in the storage device (180, 190), reception interval information indicating reception intervals between the plurality of data frames as frame information, wherein the frame information further includes a data value included in each of the plurality of data frames in association with the reception interval information; a feature acquisition step of acquiring, from the reception interval information, a feature relating to a distribution of the reception intervals between the plurality of data frames; and an unauthorized data presence determination step of determining the presence/absence of an unauthorized data frame among the plurality of data frames; wherein in the unauthorized data presence determination step, the presence/absence of an unauthorized data frame among the plurality of data frames is determined by using the feature obtained by using the reception interval information and a normal model stored in the storage device, the normal model indicating a property of normal data frames, wherein the method further comprises a grouping step of setting at least one group including at least some of the plurality of data frames on the basis of the reception interval information and the data values included in the frame information, wherein in the feature acquisition step, a feature relating to distribution of the reception intervals between the plurality of data frames included in each of the at least one group is acquired from the reception interval information included in the reception log, and wherein in the unauthorized data presence determination step, a group including an unauthorized data frame and a group not including an unauthorized data frame are identified among the at least one group on the basis of at least the feature obtained for each of the at least one group.