A data analysis apparatus, comprising: a data obtainer that obtains a plurality of anomaly analysis results from each of a plurality of vehicles, the anomaly analysis results each being a result of analyzing an anomaly in an in-vehicle network by a vehicle data analysis apparatus included in each of the plurality of vehicles and including information identifying at least anomaly data, the in-vehicle network being provided in each of a first vehicle and a second vehicle forming part of the plurality of vehicles, and including one or more buses; and a relevant Electronic Control Unit identifier that: identifies a primary ECU having higher relevance to the anomaly data indicated in the plurality of anomaly analysis results among ECUs connected to the in-vehicle network, the identifying being performed for each of the first vehicle and the second vehicle, the primary ECU being an ECU designed to transmit a CAN message that has the same message ID as that of an attacking CAN message and that is highly suspected to be providing anomaly data, identifies, as a secondary ECU set, a plurality of ECUs connected to a bus connected to the primary ECU among the one or more buses, the identifying being made for each of the first vehicle and the second vehicle, identifies, as anomaly-relevant ECUs, common ECUs included in both of the secondary ECU set identified for the first vehicle and the secondary ECU set identified for the second vehicle, the common ECUs satisfying one or more predetermined conditions, and outputs information indicating at least the anomaly-relevant ECUs. a data obtainer that obtains a plurality of anomaly analysis results from each of a plurality of vehicles, the anomaly analysis results each being a result of analyzing an anomaly in an in-vehicle network by a vehicle data analysis apparatus included in each of the plurality of vehicles and including information identifying at least anomaly data, the in-vehicle network being provided in each of a first vehicle and a second vehicle forming part of the plurality of vehicles, and including one or more buses; and a relevant Electronic Control Unit identifier that: identifies a primary ECU having higher relevance to the anomaly data indicated in the plurality of anomaly analysis results among ECUs connected to the in-vehicle network, the identifying being performed for each of the first vehicle and the second vehicle, the primary ECU being an ECU designed to transmit a CAN message that has the same message ID as that of an attacking CAN message and that is highly suspected to be providing anomaly data, identifies, as a secondary ECU set, a plurality of ECUs connected to a bus connected to the primary ECU among the one or more buses, the identifying being made for each of the first vehicle and the second vehicle, identifies, as anomaly-relevant ECUs, common ECUs included in both of the secondary ECU set identified for the first vehicle and the secondary ECU set identified for the second vehicle, the common ECUs satisfying one or more predetermined conditions, and outputs information indicating at least the anomaly-relevant ECUs. identifies a primary ECU having higher relevance to the anomaly data indicated in the plurality of anomaly analysis results among ECUs connected to the in-vehicle network, the identifying being performed for each of the first vehicle and the second vehicle, the primary ECU being an ECU designed to transmit a CAN message that has the same message ID as that of an attacking CAN message and that is highly suspected to be providing anomaly data, identifies, as a secondary ECU set, a plurality of ECUs connected to a bus connected to the primary ECU among the one or more buses, the identifying being made for each of the first vehicle and the second vehicle, identifies, as anomaly-relevant ECUs, common ECUs included in both of the secondary ECU set identified for the first vehicle and the secondary ECU set identified for the second vehicle, the common ECUs satisfying one or more predetermined conditions, and outputs information indicating at least the anomaly-relevant ECUs.