Abstract: A relay device performs relay processing of relaying data between a plurality of function units mounted on a vehicle and includes a counting unit that counts each of the numbers of relayed packets that are the numbers of packets relayed to respective target function units being the plurality of function units of a same type in the relay processing and a detection unit that monitors a count value of the numbers counted by the counting unit and detects unauthorized communication with the target function units based on a maximum value and a minimum value of the numbers of relayed packets counted by the counting unit.