Abstract: An unauthorized communication detection method detects an unauthorized communication message on an in-facility network over which at least two devices including a first device and a second device are communicably connected, and includes: receiving, from the first device, a communication message transmitted from the first device to the second device; obtaining, when the communication message is received from the first device, first information indicating a state of at least one of (a) a person in a facility and (b) the at least two devices, and determining whether to execute processing pertaining to a device control command that controls the second device when the communication message received from the first device is a communication message including the device control command, the determining being performed based on the first information; and executing the processing pertaining to the device control command when the determining determines to execute the processing.