Abstract: Provided is a detection device that detects an abnormality in a network in which a plurality of messages including a periodic message are transmitted and received. The detection device includes: a calculation unit configured to calculate a detection index that increases and decreases according to a relationship between an observation result of the plurality of messages and reference information related to the observation result; a detection unit configured to perform a detection process of detecting an abnormality in the network, based on the detection index calculated by the calculation unit; and a reset unit configured to monitor the detection index, and reset the detection index to be used in the detection process, upon detecting an extremum of the detection index.