An in-vehicle system comprising: an upper-level control unit configured to manage security of communication between a vehicle and an outside of the vehicle; one or more zone control units (20; 20A, 20B) connected to the upper-level control unit via a first in-vehicle communication network, each of the one or more zone control units (20; 20A, 20B) being configured to manage one zone on the vehicle; and a plurality of lower-level control units (31, 32; 31, 32, 33, 34) connected to a downstream side of each of the one or more zone control units (20; 20A, 20B) via a second in-vehicle communication network, wherein each of the one or more zone control units (20; 20A, 20B) comprises: a power supply control unit configured to control power supply to each of the plurality of lower-level control units (31, 32; 31, 32, 33, 34); a communication control unit (21, 22) configured to control communication with each of the plurality of lower-level control units (31, 32; 31, 32, 33, 34); and an abnormality detection unit; characterized in that each abnormality detection unit is configured to detect presence or absence of an abnormality in each of the plurality of lower-level control units (31, 32; 31, 32, 33, 34), wherein each abnormality detection unit is configured to monitor three or more elements including a power supply current value, a communication response time, and a MAC address for each of the plurality of lower-level control units (31, 32; 31, 32, 33, 34), and wherein in a case in which an abnormality for two or more of the three or more elements is detected in at least one of the plurality of lower-level control units (31, 32; 31, 32, 33, 34), each abnormality detection unit is configured to recognize that the at least one of the plurality of lower-level control units (31, 32; 31, 32, 33, 34) is an unauthorized device. an upper-level control unit configured to manage security of communication between a vehicle and an outside of the vehicle; one or more zone control units (20; 20A, 20B) connected to the upper-level control unit via a first in-vehicle communication network, each of the one or more zone control units (20; 20A, 20B) being configured to manage one zone on the vehicle; and a plurality of lower-level control units (31, 32; 31, 32, 33, 34) connected to a downstream side of each of the one or more zone control units (20; 20A, 20B) via a second in-vehicle communication network, wherein each of the one or more zone control units (20; 20A, 20B) comprises: a power supply control unit configured to control power supply to each of the plurality of lower-level control units (31, 32; 31, 32, 33, 34); a communication control unit (21, 22) configured to control communication with each of the plurality of lower-level control units (31, 32; 31, 32, 33, 34); and an abnormality detection unit; a power supply control unit configured to control power supply to each of the plurality of lower-level control units (31, 32; 31, 32, 33, 34); a communication control unit (21, 22) configured to control communication with each of the plurality of lower-level control units (31, 32; 31, 32, 33, 34); and an abnormality detection unit; characterized in that each abnormality detection unit is configured to detect presence or absence of an abnormality in each of the plurality of lower-level control units (31, 32; 31, 32, 33, 34), wherein each abnormality detection unit is configured to monitor three or more elements including a power supply current value, a communication response time, and a MAC address for each of the plurality of lower-level control units (31, 32; 31, 32, 33, 34), and wherein in a case in which an abnormality for two or more of the three or more elements is detected in at least one of the plurality of lower-level control units (31, 32; 31, 32, 33, 34), each abnormality detection unit is configured to recognize that the at least one of the plurality of lower-level control units (31, 32; 31, 32, 33, 34) is an unauthorized device.