An intrusion detection device (10, 20, 80) configured to detect intrusion into a network which is a part of a management system of a building facility, comprising: a communication acquisition unit (11, 21, 81) configured to acquire communication data related to the building facility and flowing in the network; a communication permission list generator (14, 24, 84) configured to generate a communication permission rule for permitting communication in the network and configured to store the same in a communication permission list; an intrusion detector (12, 22, 82) configured to detect intrusion into the network by comparing communication determination data including the communication data acquired by the communication acquisition unit and the communication permission rule in the communication permission list, wherein the communication determination data is a data set in which a system state of the management system and a period of the communication data are added to the communication data; and an attribute information analyzer (15, 25, 85) configured to analyze engineering information including attribute information of an object of the building facility and to extract information necessary for generating the communication permission rule, configured to formulate the information into a communication specification format of the network, and configured to output the result as intermediate data, wherein the communication acquisition unit (11, 21, 81) is configured to generate the communication determination data based on the acquired communication data, and is configured to output the same to the intrusion detector (12, 22, 82), the intrusion detector (12, 22, 82) is configured to detect intrusion into the network when the communication determination data does not correspond to any of the communication permission rules in the communication permission list, and the communication permission list generator (14, 24, 84) is configured to generate the communication permission rule by combining, with the intermediate data, management information including network structure information and object input/output information. a communication acquisition unit (11, 21, 81) configured to acquire communication data related to the building facility and flowing in the network; a communication permission list generator (14, 24, 84) configured to generate a communication permission rule for permitting communication in the network and configured to store the same in a communication permission list; an intrusion detector (12, 22, 82) configured to detect intrusion into the network by comparing communication determination data including the communication data acquired by the communication acquisition unit and the communication permission rule in the communication permission list, wherein the communication determination data is a data set in which a system state of the management system and a period of the communication data are added to the communication data; and an attribute information analyzer (15, 25, 85) configured to analyze engineering information including attribute information of an object of the building facility and to extract information necessary for generating the communication permission rule, configured to formulate the information into a communication specification format of the network, and configured to output the result as intermediate data, wherein the communication acquisition unit (11, 21, 81) is configured to generate the communication determination data based on the acquired communication data, and is configured to output the same to the intrusion detector (12, 22, 82), the intrusion detector (12, 22, 82) is configured to detect intrusion into the network when the communication determination data does not correspond to any of the communication permission rules in the communication permission list, and the communication permission list generator (14, 24, 84) is configured to generate the communication permission rule by combining, with the intermediate data, management information including network structure information and object input/output information.