A misuse detection method used in a vehicle network system including a plurality of electronic control units (100, 200) that communicate with one another through buses in accordance with a Controller Area Network, CAN, protocol, the misuse detection method comprising: a reception step of receiving a target data frame transmitted through the buses; and a detection step of performing, as misuse detection for the target data frame, which is a data frame having a first identifier, evaluation in accordance with a reception timing of a reference data frame, which is a data frame having a second identifier different from the first identifier, and a reception timing of the target data frame on the basis of a certain rule specifying a reception interval between the reference data frame and the target data frame; the certain rule specifies an appropriate range of the reception interval; in the detection step, if a difference between the reception timing of the target data frame and the reception timing of the reference data frame prior to the foregoing reception timing falls within the appropriate range, it is evaluated that the certain rule is complied with; and characterised in that the method further comprises a reference detection step of performing misuse detection for the reference data frame; and a subsequent detection step of performing, as misuse detection for the target data frame, evaluation in accordance with a reception timing of another reference data frame, which is a data frame having a third identifier different from the first identifier and the second identifier, and the reception timing of the target data frame on the basis of a rule specifying a reception interval between the other reference data frame and the target data frame, wherein, if it is detected in the reference detection step that the reference data frame is unauthorized, the misuse detection in the detection step is stopped and the misuse detection in the subsequent detection step starts. a reception step of receiving a target data frame transmitted through the buses; and a detection step of performing, as misuse detection for the target data frame, which is a data frame having a first identifier, evaluation in accordance with a reception timing of a reference data frame, which is a data frame having a second identifier different from the first identifier, and a reception timing of the target data frame on the basis of a certain rule specifying a reception interval between the reference data frame and the target data frame; the certain rule specifies an appropriate range of the reception interval; in the detection step, if a difference between the reception timing of the target data frame and the reception timing of the reference data frame prior to the foregoing reception timing falls within the appropriate range, it is evaluated that the certain rule is complied with; and characterised in that the method further comprises a reference detection step of performing misuse detection for the reference data frame; and a subsequent detection step of performing, as misuse detection for the target data frame, evaluation in accordance with a reception timing of another reference data frame, which is a data frame having a third identifier different from the first identifier and the second identifier, and the reception timing of the target data frame on the basis of a rule specifying a reception interval between the other reference data frame and the target data frame, wherein, if it is detected in the reference detection step that the reference data frame is unauthorized, the misuse detection in the detection step is stopped and the misuse detection in the subsequent detection step starts.