Abstract: A relay device includes a first input/output unit (111), a second input/output unit (112), a security monitoring unit (121) that determines whether or not a packet input to the first input/output unit (111) or the second input/output unit (112) is normal, and a relay unit (113) that outputs a packet determined to be normal by the security monitoring unit (121) from the first input/output unit (111) or the second input/output unit (112); the security monitoring unit (121) uses a whitelist to perform whitelist-based attack detection to determine whether or not a packet is normal, and uses a learning model learned through machine learning to perform machine-learning-based attack detection on a packet that is not determined to be normal through the whitelist-based attack detection, to determine whether or not the packet is normal.