An anomaly detection electronic control unit connected to an in-vehicle network used by a plurality of electronic control units (100, 200, 300, 400, 500, 600) for communication, the anomaly detection electronic control unit comprising: a receiver that receives a first communication message indicating speed information of a vehicle including the in-vehicle network and a second communication message indicating peripheral information of the vehicle; a traveling-state determiner that determines a first traveling state of the vehicle based on the speed information and a second traveling state of the vehicle based on the peripheral information; an anomaly determiner that determines, by comparing the first traveling state with the second traveling state, that the first communication message is anomalous when the first traveling state is different from the second traveling state and that the first communication message is normal when the first traveling state is same as the second traveling state; an anomaly processor that executes processing to handle an anomaly when the anomaly determiner determines that the first communication message is anomalous; characterised in that: the traveling-state determiner expresses the first traveling state using one of at least three stages, which are a high-speed traveling state, a low-speed traveling state, and a stopped state, depending on a speed of the vehicle indicated by the speed information, the traveling-state determiner further expresses the second traveling state using one of at least three stages, which are a high-speed traveling state, a low-speed traveling state, and a stopped state, depending on the peripheral information, the anomaly determiner determines a level of anomaly possibility of the first communication message based on a level of difference between the one of the at least three stages that indicates the first traveling state and the one of the at least three stages that indicates the second traveling state, and the anomaly processor performs the processing that is different depending on the level of anomaly possibility. a receiver that receives a first communication message indicating speed information of a vehicle including the in-vehicle network and a second communication message indicating peripheral information of the vehicle; a traveling-state determiner that determines a first traveling state of the vehicle based on the speed information and a second traveling state of the vehicle based on the peripheral information; an anomaly determiner that determines, by comparing the first traveling state with the second traveling state, that the first communication message is anomalous when the first traveling state is different from the second traveling state and that the first communication message is normal when the first traveling state is same as the second traveling state; an anomaly processor that executes processing to handle an anomaly when the anomaly determiner determines that the first communication message is anomalous; the traveling-state determiner further expresses the second traveling state using one of at least three stages, which are a high-speed traveling state, a low-speed traveling state, and a stopped state, depending on the peripheral information, the anomaly determiner determines a level of anomaly possibility of the first communication message based on a level of difference between the one of the at least three stages that indicates the first traveling state and the one of the at least three stages that indicates the second traveling state, and the anomaly processor performs the processing that is different depending on the level of anomaly possibility.