A system that detects any unauthorized communication without imposing a processing load on a control device is provided. In the incident detection system configured to detect any security incident, a gateway device includes: an ID generation unit that generates its own gateway device identification information; a detection packet generation unit that generates a detection packet including control information transmitted from a control device and path information obtained by adding its own gateway device identification information to a communication packet; a log generation unit that generates log information including the detection packet; and a device communication unit that transmits the log information to a management server connected to the gateway device over a network or transmits the detection packet to a control device controlled based on the control information. In the incident detection system, the management server includes: a server communication unit that receives log information from a gateway device; a communication path extraction unit that stores assumed path information, obtained by extracting path information from the log information, in a storage unit in advance; and an incident detection unit that detects any unauthorized communication packet based on the assumed path information stored in the storage unit and path information included in the log information.