Abstract: An anomaly detection method for detecting an anomaly in an in-vehicle network of an in-vehicle network system including a plurality of electronic control units that transmit and receive messages via the network includes: generating image data of a reception interval between a plurality of messages included in a message sequence in a predetermined period out of a message sequence received from the in-vehicle network, or image data of a transition of a sensor value of the plurality of messages; classifying the image data using a trained CNN according to whether an attack message has been inserted in the predetermined period; and when the attack message has been inserted in the predetermined period, outputting a detection result indicating that an insertion attack which is an insertion of the attack message has been made in the predetermined period.