An unauthorized frame detection device for an in-vehicle network system that includes a plurality of electronic control units and a plurality of networks, the plurality of electronic control units communicating via the unauthorized frame detection device through service-oriented communication, the unauthorized frame detection device comprising: a plurality of communication ports corresponding to the plurality of networks, respectively; a communication controller; an unauthorized frame detector; wherein the plurality of communication ports are each connectable to a predetermined network corresponding thereto among the plurality of networks and each include an interface for transmitting or receiving, via the predetermined network, a frame to or from an electronic control unit, among the plurality of electronic control units, that is connected to the predetermined network, when a communication port among the plurality of communication ports receives a frame, the communication controller is configured to perform transfer control of causing the frame to be transmitted from another communication port, among the plurality of communication ports, other than the communication port that has received the frame, the unauthorized frame detector is configured to make a determination as to whether an identifier of a service included in the frame, a type of the service included in the frame, and port information included in the frame match a permission rule set in advance and to output a result of the determination, the type of the service indicating whether an electronic control unit, among the plurality of electronic units, that has transmitted the frame is to offer the service or receive the service, the port information serving to identify the communication port that has received the frame, the device, characterized in that it comprises: a rule updater, wherein when a communication port among the plurality of communication ports receives a frame that includes manifest information concerning a service to be used by an electronic control unit among the plurality of electronic control units, the rule updater is configured to update the permission rule based on the manifest information and port information identifying the communication port that has received the frame that includes the manifest information. a plurality of communication ports corresponding to the plurality of networks, respectively; a communication controller; an unauthorized frame detector; wherein the plurality of communication ports are each connectable to a predetermined network corresponding thereto among the plurality of networks and each include an interface for transmitting or receiving, via the predetermined network, a frame to or from an electronic control unit, among the plurality of electronic control units, that is connected to the predetermined network, when a communication port among the plurality of communication ports receives a frame, the communication controller is configured to perform transfer control of causing the frame to be transmitted from another communication port, among the plurality of communication ports, other than the communication port that has received the frame, the unauthorized frame detector is configured to make a determination as to whether an identifier of a service included in the frame, a type of the service included in the frame, and port information included in the frame match a permission rule set in advance and to output a result of the determination, the type of the service indicating whether an electronic control unit, among the plurality of electronic units, that has transmitted the frame is to offer the service or receive the service, the port information serving to identify the communication port that has received the frame, the device, characterized in that it comprises: a rule updater, wherein when a communication port among the plurality of communication ports receives a frame that includes manifest information concerning a service to be used by an electronic control unit among the plurality of electronic control units, the rule updater is configured to update the permission rule based on the manifest information and port information identifying the communication port that has received the frame that includes the manifest information.