An attack communication detection device for detecting an attack communication from a communication of each electronic control unit in a communication network, the attack communication detection device comprising: a receiving unit configured to receive communication data for detection which may or may not include the attack communication; a temporary holding unit configured to hold a plurality of communication times of the communication data for detection in order of time from latest; a sum-of-communication-intervals calculation unit configured to calculate a sum of communication intervals, which is the sum of two adjacent communication intervals, of the communication data for detection by using the plurality of communication times of the communication data for detection; an estimated distribution model storage configured to store in advance an estimated distribution model that includes 1)-3): 1) an estimated distribution of the communication interval of communication data for learning which does not include the attack communication, 2) an estimated distribution of the sum of communication intervals of communication data for learning which does not include the attack communication, and 3) a threshold T for these estimated distributions, wherein the threshold T is determined to be more than or equal to a mean a of the communication intervals of the communication data for learning and less than a+a' which is a sum of the mean a and a predetermined short interval a'; and a detection unit configured to judge that the communication data for detection includes the attack communication if the sum of communication intervals of the communication data for detection at an arbitrary time is less than or equal to the threshold T for the estimated distributions. a receiving unit configured to receive communication data for detection which may or may not include the attack communication; a temporary holding unit configured to hold a plurality of communication times of the communication data for detection in order of time from latest; a sum-of-communication-intervals calculation unit configured to calculate a sum of communication intervals, which is the sum of two adjacent communication intervals, of the communication data for detection by using the plurality of communication times of the communication data for detection; an estimated distribution model storage configured to store in advance an estimated distribution model that includes 1)-3): 1) an estimated distribution of the communication interval of communication data for learning which does not include the attack communication, 2) an estimated distribution of the sum of communication intervals of communication data for learning which does not include the attack communication, and 3) a threshold T for these estimated distributions, wherein the threshold T is determined to be more than or equal to a mean a of the communication intervals of the communication data for learning and less than a+a' which is a sum of the mean a and a predetermined short interval a'; and 1) an estimated distribution of the communication interval of communication data for learning which does not include the attack communication, 2) an estimated distribution of the sum of communication intervals of communication data for learning which does not include the attack communication, and 3) a threshold T for these estimated distributions, wherein the threshold T is determined to be more than or equal to a mean a of the communication intervals of the communication data for learning and less than a+a' which is a sum of the mean a and a predetermined short interval a'; and a detection unit configured to judge that the communication data for detection includes the attack communication if the sum of communication intervals of the communication data for detection at an arbitrary time is less than or equal to the threshold T for the estimated distributions. <EOS>