A server, comprising: a processor configured to perform operations including: a data receiver for obtaining log information generated by a first node (10 30) that is a target to be monitored on a V2X network; a training data selector for selecting predetermined information from the log information obtained; and a learner for performing machine learning using, as training data, the predetermined information selected, to create an anomaly detection model to be used to detect an anomaly by a monitoring node that monitors the first node on the V2X network, a data storage for storing the log information received by data receiver and the anomaly detection model created by learner, characterized in that, wherein the log information includes a plurality of records and each of said records includes in association with one another: a time; status information indicating a status, of the first node at the time, as indicated by at least one of sensor data or control data on the first node; first anomaly information indicating a first result whether an anomaly occurred on the first node at the time; and second anomaly information indicating a second result whether, at the time, an anomaly occurred on the second node in a surrounding area of the first node that communicates with the first node, the training data selector performs for each record of the first node (10 30) on the V2X network, each record comprising a target record: when the first anomaly information of the target record indicates an anomaly, the target record is selected as the predetermined information; and when the first anomaly information of the target record indicates no anomaly and the second anomaly information of the target record indicates an anomaly, the target record is selected as the predetermined information, and in the performing by the learner, the anomaly detection model is created via supervised learning using, as the training data, the predetermined information selected (S57 S67 S76). a processor configured to perform operations including: a data receiver for obtaining log information generated by a first node (10 30) that is a target to be monitored on a V2X network; a training data selector for selecting predetermined information from the log information obtained; and a learner for performing machine learning using, as training data, the predetermined information selected, to create an anomaly detection model to be used to detect an anomaly by a monitoring node that monitors the first node on the V2X network, a data storage for storing the log information received by data receiver and the anomaly detection model created by learner, characterized in that, a data receiver for obtaining log information generated by a first node (10 30) that is a target to be monitored on a V2X network; a training data selector for selecting predetermined information from the log information obtained; and a learner for performing machine learning using, as training data, the predetermined information selected, to create an anomaly detection model to be used to detect an anomaly by a monitoring node that monitors the first node on the V2X network, a data storage for storing the log information received by data receiver and the anomaly detection model created by learner, characterized in that, wherein the log information includes a plurality of records and each of said records includes in association with one another: a time; status information indicating a status, of the first node at the time, as indicated by at least one of sensor data or control data on the first node; first anomaly information indicating a first result whether an anomaly occurred on the first node at the time; and second anomaly information indicating a second result whether, at the time, an anomaly occurred on the second node in a surrounding area of the first node that communicates with the first node, a time; status information indicating a status, of the first node at the time, as indicated by at least one of sensor data or control data on the first node; first anomaly information indicating a first result whether an anomaly occurred on the first node at the time; and second anomaly information indicating a second result whether, at the time, an anomaly occurred on the second node in a surrounding area of the first node that communicates with the first node, the training data selector performs for each record of the first node (10 30) on the V2X network, each record comprising a target record: when the first anomaly information of the target record indicates an anomaly, the target record is selected as the predetermined information; and when the first anomaly information of the target record indicates no anomaly and the second anomaly information of the target record indicates an anomaly, the target record is selected as the predetermined information, and when the first anomaly information of the target record indicates an anomaly, the target record is selected as the predetermined information; and when the first anomaly information of the target record indicates no anomaly and the second anomaly information of the target record indicates an anomaly, the target record is selected as the predetermined information, and in the performing by the learner, the anomaly detection model is created via supervised learning using, as the training data, the predetermined information selected (S57 S67 S76).