A detection device comprising: an object data extraction unit that is configured to extract, on an assumption that a same serial number is assigned to a series of pieces of object communication data, from one or more pieces of object communication data which are transmitted from one or more electronic control units, at least part of a payload contained in object communication data that satisfies a predetermined condition, information by which a communication interval between the object communication data can be calculated, and a serial number of the object communication data as object data; a partial sequence creation unit that is configured to create, using the extracted object data, a partial sequence containing information corresponding to at least part of a payload and information indicating a communication interval from two or more pieces of object data with a same serial number; and a detection unit that is configured to detect, using the created partial sequence and a detector, predetermined object communication data based on a temporal order relation between at least part of a payload and a corresponding part of another payload and the communication interval, wherein the predetermined condition is a condition for extracting only object communication data which is transmitted periodically and also in conjunction with a predetermined event, the detector has been created in a prior learning phase, using partial sequences created based on known communication data, the known communication data is communication data that is known to be normal or to be an attack, and the detector is configured to include a database consisting of the partial sequences created from the known communication data, search the database for a partial sequence identical to the partial sequence created from the object communication data, and obtain a detection result based on the search result. an object data extraction unit that is configured to extract, on an assumption that a same serial number is assigned to a series of pieces of object communication data, from one or more pieces of object communication data which are transmitted from one or more electronic control units, at least part of a payload contained in object communication data that satisfies a predetermined condition, information by which a communication interval between the object communication data can be calculated, and a serial number of the object communication data as object data; a partial sequence creation unit that is configured to create, using the extracted object data, a partial sequence containing information corresponding to at least part of a payload and information indicating a communication interval from two or more pieces of object data with a same serial number; and a detection unit that is configured to detect, using the created partial sequence and a detector, predetermined object communication data based on a temporal order relation between at least part of a payload and a corresponding part of another payload and the communication interval, wherein the predetermined condition is a condition for extracting only object communication data which is transmitted periodically and also in conjunction with a predetermined event, the detector has been created in a prior learning phase, using partial sequences created based on known communication data, the known communication data is communication data that is known to be normal or to be an attack, and the detector is configured to include a database consisting of the partial sequences created from the known communication data, search the database for a partial sequence identical to the partial sequence created from the object communication data, and obtain a detection result based on the search result. <EOS>