An unauthorized communication detection method in an onboard network system including a network and one or more electronic control units (100, 100a to 100g) connected to the network, that is executed by an information processing system including a memory , the memory storing a communication pattern seen in attack messages that have been received, the unauthorized communication detection method comprising steps of: a communication pattern determining step (S1002) of determining whether or not a message matches the communication pattern identified in the communication pattern identifying step, an unauthorized activity detection step (S1002) of determining, based on rules and a result of the communication pattern determining step whether or not the message sent out onto the network is an attack message; an information saving step (S1004) of saving information relating to the attack message determined in the unauthorized activity detection step (S1002) in the memory in a case where the message is an attack message; a communication pattern identifying step (S1006) of identifying a communication pattern occurring on the onboard network, from the information relating to the attack message stored in the memory and updating the communication pattern in the memory; and wherein at least the unauthorized activity detection step and the communication pattern determining step are executed on each of a plurality of messages that have been successively sent out onto the network and received, and wherein, in the unauthorized activity detection step executed on a second message among the plurality of messages received after executing of the communication pattern determining step, determination results of this communication pattern determining step that has already been executed on a first message among the plurality of messages are used for determining whether or not this message is an attack message. a communication pattern determining step (S1002) of determining whether or not a message matches the communication pattern identified in the communication pattern identifying step, an unauthorized activity detection step (S1002) of determining, based on rules and a result of the communication pattern determining step whether or not the message sent out onto the network is an attack message; an information saving step (S1004) of saving information relating to the attack message determined in the unauthorized activity detection step (S1002) in the memory in a case where the message is an attack message; a communication pattern identifying step (S1006) of identifying a communication pattern occurring on the onboard network, from the information relating to the attack message stored in the memory and updating the communication pattern in the memory; and wherein at least the unauthorized activity detection step and the communication pattern determining step are executed on each of a plurality of messages that have been successively sent out onto the network and received, and wherein, in the unauthorized activity detection step executed on a second message among the plurality of messages received after executing of the communication pattern determining step, determination results of this communication pattern determining step that has already been executed on a first message among the plurality of messages are used for determining whether or not this message is an attack message. <EOS>