An anomaly detection device is located between a network and a first ECU in the plurality of ECUs, and includes: a communication circuit; a processor; and a memory including a set of instructions that, when executed, causes the processor to perform operations including: receiving a message from the first ECU and transmitting the message to the network, and receiving a message from the network and transmitting the message to the first ECU, using the communication circuit; holding, in the memory, a received ID list; when an ID of the message received by the communication circuit from the network is not included in the received ID list, adding the ID to the received ID list; and when an ID of the message received by the communication circuit from the first ECU is included in the received ID list, causing the communication circuit not to transmit the message to the network.