An anomaly detection device, ECU, for inclusion in an in-vehicle network comprising a plurality of communication devices comprising electronic control units, ECU's, configured to communicate using a FlexRay protocol, thereby adopting a time-triggered protocol based on a time slot, the plurality of communication devices, ECU's, configured to connect to each other, each of the plurality of communication devices configured to transmit or receive one or more frames for each predetermined time slot among a plurality of time slots included in a plurality of cycles including a predetermined cycle, the anomaly detection device, ECU, comprising: a frame receiver configured to receive the one or more frames; and a holder (253 254 255 256 257), said holder comprising an authorized ID list for verification of a valid frame ID of at least one of the received one or more frames, at least one rule for said valid frame ID, for use in an individual frame anomaly detection process, a reception history for use in the individual frame anomaly detection process, a cycle-specific rule for use in a cycle-specific anomaly detection process, a frame type-specific rule for use in a frame type-specific anomaly detection process; and, an anomaly detector configured to perform the individual frame anomaly detection process and the cycle-specific anomaly detection process and the frame type-specific anomaly detection process, and thereby detect an occurrence of an anomalous frame in accordance with a number of repeated cycles of each cycle in the plurality of cycles and the each predetermined time slot in which each of the one or more frames is received by the frame receiver, wherein the anomaly detector is configured to perform the detection by verifying a statistic on the one or more frames against at least one of the rules indicating a reference range of the statistic, the one or more frames being received in at least one cycle including the predetermined cycle. the plurality of communication devices, ECU's, configured to connect to each other, each of the plurality of communication devices configured to transmit or receive one or more frames for each predetermined time slot among a plurality of time slots included in a plurality of cycles including a predetermined cycle, the anomaly detection device, ECU, comprising: a frame receiver configured to receive the one or more frames; and a holder (253 254 255 256 257), said holder comprising an authorized ID list for verification of a valid frame ID of at least one of the received one or more frames, at least one rule for said valid frame ID, for use in an individual frame anomaly detection process, a reception history for use in the individual frame anomaly detection process, a cycle-specific rule for use in a cycle-specific anomaly detection process, a frame type-specific rule for use in a frame type-specific anomaly detection process; and, an anomaly detector configured to perform the individual frame anomaly detection process and the cycle-specific anomaly detection process and the frame type-specific anomaly detection process, and thereby detect an occurrence of an anomalous frame in accordance with a number of repeated cycles of each cycle in the plurality of cycles and the each predetermined time slot in which each of the one or more frames is received by the frame receiver, wherein the anomaly detector is configured to perform the detection by verifying a statistic on the one or more frames against at least one of the rules indicating a reference range of the statistic, the one or more frames being received in at least one cycle including the predetermined cycle. a frame receiver configured to receive the one or more frames; and a holder (253 254 255 256 257), said holder comprising an authorized ID list for verification of a valid frame ID of at least one of the received one or more frames, at least one rule for said valid frame ID, for use in an individual frame anomaly detection process, a reception history for use in the individual frame anomaly detection process, a cycle-specific rule for use in a cycle-specific anomaly detection process, a frame type-specific rule for use in a frame type-specific anomaly detection process; and, an anomaly detector configured to perform the individual frame anomaly detection process and the cycle-specific anomaly detection process and the frame type-specific anomaly detection process, and thereby detect an occurrence of an anomalous frame in accordance with a number of repeated cycles of each cycle in the plurality of cycles and the each predetermined time slot in which each of the one or more frames is received by the frame receiver, wherein the anomaly detector is configured to perform the detection by verifying a statistic on the one or more frames against at least one of the rules indicating a reference range of the statistic, the one or more frames being received in at least one cycle including the predetermined cycle.